I think entities need a clear signal.
If you're a university or a private sector company, to be fair, you now need to.... Australia ran into this problem, where all foreign actors need to be treated equally. If you're a foreign visitor to a university from Germany or you're a foreign visitor from some hostile state, the university cannot treat the risk assessment differently. It means that you cannot deploy the very scarce resources you have in a targeted fashion, so it's just giving the minister the option.
The other advantage is that it allows the government to negotiate. If it gets indirect threats from a hostile state actor, the government can now indirectly signal that, if they're going to treat us like that, we might end up listing their particular country and maybe two can play at this game.