They didn’t. It’s the ATF extrapolating their authority and oversight and then couching it as “administrative law.”
A lot of gov agencies take it upon themselves to make law, unconstitutional laws, via a SC ruling called Chevron Deference. They apply an overly broad interpretation to laws and regs and make “laws”.