You can read the text:
https://eur-lex.europa.eu/eli/reg/2022/2065/oj/engIf English isn't your native language, that's okay - these are translated into every European language and you can select a translation here.
Article 25, clause 1:
> Providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions.
These EU regulations tend to specify policies, not mechanisms to achieve them. Mechanisms to enforce the policy, however, are specified.
They are written like that precisely so you won't try to weasel your way around a requirement. If they had said "verified badges may not be sold" then you would try to say "this isn't a verified badge but a they-paid-us badge." By wording it vaguely, it cannot be weaseled.
And indeed, it is a they-paid-us badge... but it's designed to look identical to the verified badge, on purpose, because Elon knew verified badges were something people wanted, and people wanted them because they were a status symbol, and they were a status symbol because they indicated your account was in some sense more trustworthy than average. And Elon knew that.
I don't know whether people still see the badges that way today. Probably not, because all the sane people deleted their accounts and don't care. But it was the case, when the badges were introduced, that they were designed to trick people who didn't know they were now pay badges. You might think everyone knew that, but that's just because everyone in your bubble knew that because they're very online people. Would your grandmother know it?