Securities laws have an almost unique structure: forbid everything and then allow action through certain exceptions. The default prohibition is found in Ontario securities laws, and the other provinces, and in America (which is the origin of Canadian securities laws, see footnote #1). Some of the exceptions are quite broad, others much more narrow. There are many, many exceptions from the general rule of prohibition. The exceptions are designed to permit the existing markets and players in the securities industry. But this is a fairly unique legal structure. Most laws have a list of what can't be done, rather than prohibiting everything and then listing what can be done. This subverts the general legal maxim that what is not prohibited is permitted.
Many people have a hard time with understanding securities laws because they turn the general rule on its head. People are much more used to a system in which certain activities are prohibited. In a sense, securities laws are like that, but the legal structure of how that's achieved is the inverse. Securities laws are not a list of what can be done but rather exceptions from the rule that all cannot be done. This gives enormous flexibility to the regulator tasked with enforcing the law but also creates uncertainty for market participants who may not be sure what they are permitted to do. Savvy market players often operate at the edge of what's permitted or not, and sometimes their activities are legalized and become a part of the standard practice (e.g. RTOs).