Given that there's no list of forbidden books, nor any realistic way of determining beforehand whether a specific book would be considered detrimental to China's security or otherwise would be illegal, is it actually a law?

I am inclined to contrast it to what it's like in my own country. Canada, of course like every country, has a variety of laws that prohibit certain kinds of expression.

The difference is that, while you may need to brush up on your legal scholarship and perhaps consult a lawyer, you can be quite confident, before you commit an act, whether it is or isn't actually illegal. For matters on the fringes of jurisprudence, the debate whether it is or isn't banned will occur publicly at trial, with reasons given and debated based on the text of the laws in question, and stand as precedent for what counts as illegal under that law.

The content of a law may be arbitrary, but they aren't arbitrarily made up as you go. That's not law then, it's the fiat of a dictator.