There's nothing complex and impossible about removing some "if" statements responsible for code signature enforcement.
On the surface, it's easy to do. But that is also based on the assumptions where they had to maintain some first party apis vs now having to create and maintain them so that third parties could use it. If they are committed to security which apparently DSA mandates, they have to devote many resources on it to ensure there are no threat vectors. Plus, there is no set guidelines on how much the APIs need to offer, it will be another session where competition asks for more and they will be asked to do that too.
I agree that a lot of websites (mostly news websites) have the "ad tracking or subscription" model, and I'm not sure if there has been a clear ruling in it yet, but maybe the DMA makes this stricter for Meta since it is a Gatekeeper
But DMA regulators dont agree calling it a false choice and asking meta to monetize by non personalized ads. The thing as you mentioned is how other publishers have the same model, which was never objected by any authority under GDPR either (so they clearly seem to think the model is valid). Its obviously a sticky situation where rules are different for different companies in the same jurisdiction when they are offering the same thing.
A counter could be whether if Meta isn't allowed, would no one else be allowed, but you already know the answer to that question.