The reason is that EASA cannot provide legally binding interpretations of EU Regulations, and the Certification Specifications are an interpretation of the EU Regulations.
Within the European Union (EU), legally binding interpretations of the EU regulations are exclusively provided by the national and EU courts and the European Commission. The EU Member States are responsible for interpreting and implementing EU law in their national legal system.
The European Commission (EC) has created the European Aviation Safety Agency by decision EC 218/2008, recently repealed and succeeded by EU 2018/1139. The EC tasked EASA with creating certification specification and other material:
EU 2018/1139, Article 76
- The Agency shall, in accordance with Article 115 and with the applicable delegated and implementing acts adopted on the basis of
this Regulation, issue certification specifications and other detailed
specifications, acceptable means of compliance and guidance material
for the application of this Regulation and of the delegated and
implementing acts adopted on the basis thereof.
And thus EASA is tasked with creating certification specifications that allow application of the high level EU aviation safety regulations, which requires of course the interpretation of those regulations.
At the same time, they don't have the power to give a legally binding interpretation, because that is reserved for the national and EU courts and the EC.
Consequently the Certification Specifications published by EASA that give the required detail to comply with the regulations, are not binding. They are referred to by EASA as "soft law", whereas the Regulations and Implementing Regulations on which they are based and which are published by the EC are referred to as "hard law"
As an aircraft manufacturer, you may argue that there are alternative ways of complying with the EU aviation safety regulations (hard law), whilst deviating from the Certification Specifications (soft law). If you make your case well, you will still get a type certificate.
This is not any different in the US, where aircraft can be certified with deviations from FAR 25. You don't necessary need to show compliance with all of FAR 25, if you can convince the FAA that the deviation from FAR 25 is reasonable and safe, a type certificate will be granted.
For example, see this table of granted exemptions from FAR 25 for the Boeing 737-8 and 737-9:
source: 737 type certificate(PDF)
Relevant EASA FAQ's: