It could also just be liability concerns -- I know I personally considered turning off a (free & gdpr-compliant) side project I maintain out of concern around what might happen to my bank account were a security incident were to occur affecting EU citizens.