I would think any small software shop outside of Europe is better off blocking all EU IPs rather than risk having to lawyer up when they wind up being targeted

I would think any small software shop outside of Europe is better off blocking all EU IPs rather than risk having to lawyer up when they wind up being targeted and potentially face a $20m fine. It would be financially irresponsible to do otherwise unless they have some kind of GDPR insurance policy (if such a thing exists.)