That's not quite accurate. There is now a legal mechanism that allows certain government agencies to force you to add a backdoor to your product. But until you are given a notice you don't need to do anything, and you can provide aggregated statistics to your users of how many requests you've been given. There are also some weasel-word caveats (the backdoor cannot be a "systemic vulnerability" but there has been much disagreement about whether this limitation actually means anything -- in my view it's basically meaningless within the context of a single company's product).

There is currently a review process open for the TOLA Act that closes in April[1], so any fellow Australians on HN should submit their comments -- there are only 65 submissions so far (and only 27 are by individuals).

[1]: https://www.aph.gov.au/Parliamentary_Business/Committees/Joi...