Re: Is this even legal in the EU?
If it were an aircraft, the authority holding the type certification (i.e. the manufacturer) can withdraw the certification, at which point it suddenly becomes not legal to fly that type of aircraft, no matter who owns it. (This does happen, although only rarely; usually, the authority specifies that the type can't be flown until some sort of maintenance is performed when a design or operation problem is discovered.)
This sort of legislation is completely impractical for electronic goods, even if the manufacturer has forgotten to disable the halt and catch fire instruction in the OS before shipping. So this becomes a question for the company of which is worse on the risk vs cost front. Samsung has decided that the risk/cost of allowing more devices to catch fire is worse than the risk/cost of annoying a large number of their own customers. i.e. they probably believe that the number of devices which will be prone to catch fire is large.
Samsung has clearly decided that the cheapest option is not to keep the money already given to them by consumers, but to give it back to them, and then have to pay more money to get their devices disposed of. Speaking purely in a personal capacity, if I owned one of those devices, I *wouldn't* be blocking the update, I would be getting the device out of my possession as soon as possible.