> the user has a right to legal protection if they are a citizen of a GDPR-protected country and are residing in a GDPR-bound country, regardless of what their IP address is.

Nit pick: GDPR is written in terms of people "in the Union", not citizens.