That's wrong. According to EU, GDPR applies to EU residents and the companies need to protect EU resident privacy no matter which country they hail from.
Doesn't this mean that US customs should comply with GDPR when collecting data from EU citizens? I don't remember being notified of my GDPR rights when entering US last time. I suppose this boils down to enforceability.