Nobody knows.
The relevant parts of the bill:
317ZG:
(1) A technical assistance request, technical assistance notice or technical
capability notice must not have the effect of:
(a) requesting or requiring a designated communications provider to
implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection; or
(b) preventing a designated communications provider from rectifying a systemic weakness, or a systemic vulnerability, in a form of electronic protection.
(2) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to
implement or build a new decryption capability in relation to a form of electronic protection.
(3) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to one or more actions that would render systemic methods of authentication or encryption less effective.
...
For the purposes of subsections (4A) and (4B), an act or thing will, or is likely to, jeopardise the security of information if the act or thing creates a material risk that otherwise secure information can be accessed by an unauthorised third party.
So, a company can't be forced to break an encryption algorithm, or introduce a vulnerability that affects everyone equally. But...
317B:
systemic vulnerability means a vulnerability that affects a whole class of technology, but does not include a vulnerability that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified.
systemic weakness means a weakness that affects a whole class of technology, but does not include a weakness that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified.
They can be compelled to break the encryption used by a specific person, or introduce a vulnerability into encryption as used by a specific person.
Key escrow could be considered a technology that satisfies both criteria, although it carries the risk that the stored keys could be stolen by an unauthorized third party. It's up to the courts to decide if this constitutes a "material risk". There are other techniques that involve installing backdoors for everyone and then only activating a particular backdoor, but they carry the same risk as key escrow, plus the additional risk of independent discovery of the backdoor. Again, this is something the courts will need to rule on.
