To address certain points in the question:
further reading has suggested that [secondary legislation] is not required because the change was made using the mechanisms of Article 50, which is part of the EU treaty which will (ironically) take [precedence]
This isn't true. For the European Union (Withdrawal) Act 2018 to be effective, it's necessary for the exit date specified in the Act to match the date agreed by the EU and UK, and that can only be done by secondary legislation, as specified in the Act. From section 20(3):
Subsection (4) applies if the day or time on or at which the Treaties are to cease to apply to the United Kingdom in accordance with Article 50(3) of the Treaty on European Union is different from that specified in the definition of “exit day” in subsection (1).
Section 20(4) grants the government the power to ensure that this is the case:
A Minister of the Crown may by regulations—
(a) amend the definition of “exit day” in subsection (1) to ensure that the day and time specified in the definition are the day and time that the Treaties are to cease to apply to the United Kingdom, and
(b) amend subsection (2) in consequence of any such amendment.
Schedule 7, Part 2, section 14 then specifies that parliamentary approval is required to do this:
A statutory instrument containing regulations under section 20(4) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.
Returning to the question:
This seems wrong though because in effect the EU could have offered a date that was unacceptable to the UK, without the UK being able to reject it.
That's not true. Any extension requires an agreement between the UK and EU. To quote from Section 3 of article 50 of the Treaty on European Union:
The Treaties shall cease to apply to the State in question from the date of entry into force of the withdrawal agreement or, failing that, two years after the notification referred to in paragraph 2, unless the European Council, in agreement with the Member State concerned, unanimously decides to extend this period.
Hence if the EU offers a date that the UK finds unacceptable, the UK is free to reject it, and so leave the EU on exit day.
Note that changing the exit date in the Act is entirely dependent on a new date first being agreed by the UK and EU. It is a bookkeeping exercise, not an opportunity for Parliament to reject the agreement. Having said that, it is unclear what would happen if Parliament were to reject this change.
TL;DR: Any new exit day must be agreed by the UK and EU. The date specified in the Act must match this, and the Act grants the government the power to ensure this is the case, subject to approval by Parliament.
UPDATE: The statutory instrument - The European Union (Withdrawal) Act 2018 (Exit Day) (Amendment) Regulations 2019 - was approved by both Houses on 27 March 2019. It was approved by the Commons by 441 votes to 105 (item 10 here), and by the Lords without a vote.
UPDATE 2: As described in this question, the mechanism for changing exit day in UK law has since been modified, and exit day was then changed again on 11 April 2019.