It gets back to what I was initially saying about the direct relationship. In the NFL, the league isn't simply a sanctioning body - but a private enterprise comprised of 32 private organizations. The league has direct control in the relationship between the teams and the players. (For instance, the league approves contracts - which are league-controlled standard agreements. The league sets and controls many aspects of the employer/employee relationship and not simply the rules of game and how the competition is conducted).
These things are never black and white. It's all about points and counterpoints that make up a particular theory or result. But I think there are many aspects of the relationship between an NFL player and the league as an enterprise that are not analogous to the relationship between the college athlete and the NCAA.
When you have some legal distance, you want to maintain it. So I think that's likely behind the NCAA's decision not to mandate specific concussion protocols. Could someone try to make the case that the relationship was already sufficiently direct that the NCAA had an obligation to mandate reasonable protocols rather than leaving them to the schools? Sure, someone could argue that.