If my understanding of the legislative EU process is somewhat correct, this effectively leaves it up to the countries to decide (as EU laws just mean that countries have to pass a law enacting it).

It's not rare to phrase laws this way in germany at least. It's not necessarily bad, as it allows court interpretation to change alongside societal values. In this case it would likely lead to only some countries actually passing mass surveillance laws (it's pretty unambiguously unconstitutional in a bunch, which makes it clear that mass surveillance is not "reasonable". Not that that always stops legislators, but it would at least die before the highest court eventually).

So we still need to fight it, because it's the first line of defense. Really what we need to push for would likely be explicitly disallowing blanket scanning of communication on the EU level, or proposals like this will happen again and again.

Yeah that seems like something that can't be put into a law. Well normally.