If Epic chooses not to follow the rules, then Apple chooses not to trust them to deliver executable code to users.
You are arguing that Apple is incorrect to assert that rulebreakers should not have privileges to deploy code to end-user devices worldwide, when the rule is not one that protects users.
Apple's counter-argument would presumably be that this business rule exists specifically to protect users from being harmed by developers, given the prevalence of "free trial" subscription scams over the past X decades of Internet marketing (and before that, TV commercials).
So, I don't buy the argument that Epic did nothing unsafe. It takes seconds to construct multiple scenarios where users have been abused by third-party payment systems, such that Apple would consider them "malicious behaviors that impact the user".
ps. There's a technicality branch here on "malware" != "malicious behaviors", but, like, malicious payment processing is implemented using software, "malware" is "malicious software", so "malware" still applies to the scenario I constructed above — and that flexibility demonstrates why "malware" is a terrible abbreviation for whatever everyone individually thinks it means.