In my opinion, it shouldn't be up to the whims of companies to decide who they share your private data with if they don't have your explicit permission, or a valid warrant, subpoena or court order, to do so.
Because users explicitly click on the Agree button when they signup.
That view would completely void any possibility of giving consent to anything, ever.
The same logic could be used after the fact to sue your doctors for example. "Sure I signed something, but that couldn't have been informed consent when I didn't yet know that the operation was going to go poorly."
In my opinion, the USA deserves a similar law to protect its citizens from this type of crap. Unfortunately, privacy protection doesn't seem to be a very popular topic in American politics.
Before GDPR, there already were other protections against domestic three letter agency surveillance. As Snowden showed us, this was easily circumvented by getting UK to spy on US citizens instead and sending over the data (and vice versa).
If you have information on someome the police asks for, there are strict processes that need to be followed. Sharing information with the police at a mere request, like what happened in this case, may even force you to inform the people whose information you have provided. Unless law enforcement can demand confidentiality, they're a normal party in the eyes of the law.
For example, when the police requests security camera owners for footage in a wide area around where a crime took place, sharing that footage may be illegal without blurring or cropping if other innocent people not matching the suspect's description are in clear view, or you may need to inform those people that you have provided the police with footage they're visible in. This very much depends on where the camera is located and where it's pointed at, and I doubt anyone had ever filed a GDPR complaint with their DPA about it, but without following the proper legal process, the police is as valid a party to share information with as any other person or organisation.
In this case, where the police asked Apple but did not fully utilise their investigatory powers (because Apple could've demanded a warrant), a GDPR-like law would've made it harder for governments to spy on people. It's not like warrants are hard to come by for spy agencies, but such warrants would at least produce a paper trail of some kind in the case of a witch hunt.