It requires just the one specific method of cancellation. Good actors will have multiple methods to make things easier for people, but the rules aren't for them. The rules are for the bad actors who don't want to make it easy, and who will do the absolute minimum required. As I said before, the issue is the creation of the loophole: by specifying that the same workflow must be used, by making your workflow highly directional, you can comply with the rule while still screwing people over.
Instead by focusing on how easy the workflow is, you regulate what people actually care about. If unsubscribing via the third party actually is as easy as subscribing, that's good enough; but if it isn't they have to implement better options.
I can understand that. I think the reasoning for tight restrictions is mostly to minimize the opportunity for dark patterns.
So instead of saying "cancelling must be possible through the same workflow as subscribing", regulators could also mandate something like the following:
Option A: Design a web unsubscribe workflow once as part of the regulation process, consult with UX expert to ensure it's accessible and low-friction, then mandate that providers must provide an unsubscribe flow that very closely resembles the designed workflow (using the same steps, same visual assets, etc).
Option B: Design a web API for unsubscribing, mandate that providers implement it and leave the UI to browser vendors or other third parties that have no interest in adding friction to the process. (This unfortunately risks a conflict of interest if browser vendors themselves offer subscriptions)
I'd honestly have wished that the EU had used one of those approaches for GDPR consent management - then we wouldn't have the current mess of intentionally tedious consent dialogs.
Instead by focusing on how easy the workflow is, you regulate what people actually care about. If unsubscribing via the third party actually is as easy as subscribing, that's good enough; but if it isn't they have to implement better options.