Because it's an EO, which is not a law. EOs can only direct how the executive branch functions. Sometimes it could include calls for regulation if there are pre-existing regulatory powers.
EOs have force of law if exercising valid executive authority. POTUS could have, e.g., conditioned federal contracts on compliance with this vetting program, but didn’t.
