I thought the ATF couldn't make law, only Congress could.
There's a huge debate on that, far, far, far, beyond THR's scope and purview.
But, the modern reality is that the Administrative Agencies have had the burden, for many, many decades, on how to enforce the Laws enacted by Congress.
So, they are, to pick a word, "empowered" to create Federal Regulations so as to be able to enforce the Laws duly Enacted.
The presumption here is that 18 USC 922 requires enforcement, and the Agency tasked with that Enforcement, defines the Rules it operates under. Madison, and John Adams especially, would likely be appalled. They are not here to give us counsel on such matters, sadly.