SLF3, '…
safely disable MCAS after one actuation, why do you need it in the first place?'
In part see
Boeing 737 Max Recertification Testing - Finally. and
Boeing 737 Max Recertification Testing - Finally.
'… why is it acceptable to turn it off when the certification standard '
There are many safety and certification arguments in regulatory documents; essentially the difference is between normal and abnormal (emergency) operations. MCAS can be compared with requiring two engines, but if one fails then the aircraft must be able to fly and land at a suitable airport.
EASA position; wait and see, particularly if they comment publicly or not on the NPRM.
Reading between the lines; the modifications explained in the NPRM suggest that a compromise (equivalent level of safety) has already been agreed for detecting AoA failures and MCAS inhibition, particularly reducing the pilot's contribution. More info required for ADIRU AoA 'valid' cross monitor and in some circumstances the choice of which AoA to use (valid erroneous data ??).
Similarly, a compromise for manual trim range, but not necessarily all failures for '737' stab trim runaway - but arguments have been made for previous variants and accepted.
One unknown is the view about multiple alerts stemming from a single AoA failure. The NPRM discusses the provision of 'AoA Disagree' to aid diagnosis, but until the new checklist is published the diagnosis is unknown. Also the 'disagree' alert appears to be dual purpose ((MCAS diagnostic at 5 deg, and AoA EFIS indicator 10 deg), which could be misleading.
There is no discussion about continuous stick shake - stall warning, whether to inhibit or not. The weakness is that a single AoA failure can simultaneously disable stall warning and a stability enhancement (MCAS) for increasing stick force high AoA; in this the three AoA argument is valid, but wait for the detail on alternative mechanisms for computing AoA validity (ADIRU). Also note MCAS only required flaps up, and greater focus on speed (which could have errors), but there is a standby system for that - workload argument.