Honest question: unless you're top 100 market cap companies in the world, what's actually the practical consequence of not following GDPR as a non-European comp

Honest question: unless you're top 100 market cap companies in the world, what's actually the practical consequence of not following GDPR as a non-European company? What's the most they can do in theory -- like issue a court order for a fine? (Practically are they doing this for >top 100 companies?) And suppose a fine is issued, what's the enforcement? Do US courts or US banks actually enforce these orders? Are there historical cases of this? In theory maybe they can apply to their local (European) ISP to block your site. Have they done this historically? I'm asking because to a degree, some laws about the Internet feel like international law. That is, there's no good enforcement of it because the state (the monopolist on violence) doesn't generally care about these laws. The European state can obviously enforce GDPR, but if you're outside the practical reach of the European state, what real incentive does that company have to care (beyond standard "moral" reasons).