Seems to me Instapaper painted a big target on their chest: "We're not compliant, and we're going to give EU users the middle finger in the meanwhile." Whereas, their size and business model may have staved off the data protection authorities attention, now a bunch of angry users may well be issuing complaints.
Roughly speaking, yes. E.g. a Brazilian business not specifically targeting transactions within the EU or EU nationals doesn't come under the GDPR. Conversely, an EU business basically has to apply the GDPR to any data collected inside the Union, regardless of the individual's nationality. (Obviously, this gets messier online, but if the currency was e.g. Euros and the company is in Belgium, probably covered.)
Having said that, you might have trouble as a non-EU resident to get the data protection agencies to care for trivial, individual cases. (My opinion as a European, not a fact.)
Travel is probably one of the hairier issues. For companies which are big enough and do have an EU legal presence, they might get pushed to comply. Obviously, while someone is in the EU, EU laws regarding the treatment of that person apply. If you (as a data controller) are in the EU, of course you should comply, even if the basis of your legal relationship was formed outside of the EU.
The only sources which do mention those are informal and imprecise third-party summaries. But yes, this mistake has been spread widely.
The more precise compliance guides from, say, European law firms don't mention citizenship or nationality either.
I strongly suspect that the GDPR applying retroactively will get litigated and will have a very difficult time legally.