But they have european entities (AWS, fulfilment centres, etc).
If they don't choose to put themselves somewhere, everyone may go after them separately.
... and then they can negotiate with the country that gives them the smallest punishment. (under gdpr only one will go after them at a time).
Negotiating with every country in the EU serially is not that much better than in parallel.
Likely Luxembourg, where they are headquartered. Unfortunately (as we found in the DieselGate scandal -- where car companies directly caused thousands of deaths), Luxembourg doesn't have very strong regulatory teeth. Here's hoping they're more strict.
Not really? Any EU customer could report them to their own DPA who would have to investigate the issue and resolve it. There's no reason any DPA in Luxembourg would have to be involved the way I understand it (except for customers in Luxembourg of course).