That used to be the case. i.e. if imposing Chat Control on all countries would have required a treaty it would hardly have any chances. However national governments have delegated the right to EU institutions to impose mandatory regulations. You can’t pick and chose anymore.

Not really.

Norway is not EU, it's EEA, which is more like what you describe (the population rejected joining twice in referendums, but the politicians still wanted some treaties).