Doesn't this mean any US company with data on EU users is technically in violation?
Without a footprint in the EU, there is no legal action the EU can take against a foreign organization. Sure, the EU might ban your organization from operating legally in their markets, but again, there is no legal recourse for the EU. You might as well circumvent the ban too.
I’m thinking for startups, maybe default to servers in EU. Until you get big enough where you can handle complex geographical distributed infrastructure.
And further that there are probably a lot of GDPR violations going on in the U.S but those are obviously harder to actually enforce (GDPR enforcement is already a big issue _within_ the union).