“Everyone spies on everyone, and nothing can be done” is a stronger sentence than the public record. The record is enough on its own.
In April 2015 Der Spiegel reported that NSA selectors were run through the BND station at Bad Aibling against officials at the Elysee, the French foreign ministry and the European Commission. Jean-Claude Juncker asked Berlin to explain it.
In May 2021 DR reported that Danish defence intelligence helped the NSA collect on Angela Merkel and other European officials. The Guardian’s account:
The domestic half is PEGA. Parliament adopted the spyware recommendation on 15 June 2023: use against journalists, politicians and activists inside the Union, and a demand for conditions before further use.
https://www.europarl.europa.eu/doceo/document/TA-9-2023-0244_EN.html
Ursula von der Leyen can describe the EU as strategically autonomous. These three documents are still the constraint on that sentence. Autonomy would be published limits on what a partner may collect from European soil and from EU institutions, plus a PEGA follow-up that changes practice. It is a choice. It is not a law of nature that the collection must continue, and it is also not something a press-conference adjective has already fixed.