You have to be careful about being speculative, but we've already seen the government make a policy statement in 2022 regarding a requirement to remove equipment from specific suppliers from the infrastructure, namely telecommunications providers, so that's an example.
The order-making powers are very broad, as you know: “to do anything, or refrain from doing anything”. It could be cutting off service to a particular organization, individual, or what have you. It could be requiring you not necessarily to take out equipment from your infrastructure, but to put certain equipment into your infrastructure, or to comply with certain standards. It could be weakening encryption, or it could be requiring you to intercept communications.
The way it's currently drafted could be very broadly interpreted.