Part of the problem is also that the government agencies tasked with regulating these things are hopelessly slow in pursing matters, especially when non-EU companies are concerned.
Failure to ensure the security of personal data (Article 32 of the GDPR)
At the time of the online investigation, when creating an account on DISCORD, a password of six characters including letters and numbers was accepted.
The restricted committee considered that DISCORD's password management policy was not sufficiently strong and restrictive to ensure the security of users' accounts.
Key section is probably this one: https://gdpr-info.eu/art-32-gdpr/
Of course, every time I point this out, people get mad at me because they happen to like the law (ie, they like the idea of privacy, and privacy theatre is comforting to them).
I'm personally of the opinion that one government telling me what to do is quite enough, thank you very much.
Actually in practice many important US companies do have market activity or assets in the EU, arguably including Y Combinator. Also, the EU (or its governments) wouldn't bother a random plumber in Iowa or honestly even in Prague (unless in the latter case someone have bothered to complain).
If you never have any plans to step foot in the EU, then they can't do anything to you.
You, personally, are not subject to EU laws since you are, presumably, not running a business with EU customers or data subjects.