My answer would be that many jurisdictions are struggling with this issue. The jurisdictions that inherited the Digital Millennium Copyright Act treatment of TPMs as access controls are all struggling with what to do about this. There's no golden case for how it can be best approached.
However, as for the concerns about CUSMA, we've been cautioned that there's an issue with it that we need to be careful about, but what that is can't really be articulated. Personally, I don't find that very satisfactory or persuasive. Article 20.66(4)(h) of CUSMA gives us a clear path to enact new exceptions precisely like this one.
In the absence of a reason that this wouldn't fit within that framework, I think we ought to proceed on the assumption that it's consistent with CUSMA.