They automatically unlock it once it’s paid off. They have a disclaimer that it needs to stay on the network for 60 days after it’s paid off, but I think that’s a CYA because mine was unlocked within a day of the last payment.
I just checked and I have 6 unlocked phones on my account and never requested any of them.
Requiring a support contract to receive continuing updates of software that was very publicly approaching end of support, with published EoL dates for years now does not break any laws.
By that logic, no support contracts are legal in the EU at all, and no product would ever be sunset.