Just to be clear this is the legal situation:
(everyone take his decisions and maybe you have just luck)
At the EU border, checks are compulsory.
Any plants coming from outside the EU must enter via an EU Border Control Post (BCP) and get document, identity, and physical checks.
Who is the importer?
The person the parcel is addressed to is treated as the “operator responsible for the consignment.” A seller or “middleman” in the EU doesn’t change that if the box ships to you directly from a non-EU country.
Pre-notify in TRACES (CHED-PP).
Before arrival, the operator responsible must file an online Common Health Entry Document for Plants & Plant Products (CHED-PP) in the EU’s TRACES system and present the parcel at a BCP.
If something’s wrong, you pay.
If the consignment fails the checks (wrong papers, pests, wrong routing, etc.), authorities can order destruction or special treatment and bill the operator responsible for the costs.
Phytosanitary certificate is mandatory.
Plants for planting must be accompanied by a valid phytosanitary certificate; only a few narrowly defined items are exempt.
Some plants are classed “high-risk.”
The EU keeps a High-Risk Plants list that are temporarily banned from import until a risk assessment is done. That is the case with Citrus.
Bottom line:
Even with an EU “middleman,” if the parcel ships directly from China to you, you are the importer. Without BCP entry, CHED-PP, and a valid phytosanitary certificate, the shipment will be stopped and usually destroyed at your expense, and you can face national penalties on top.
e.g. Germany: fines up to €50,000.
If you break plant-health rules, German law allows administrative fines up to €50k (on top of losing the goods).