GDPR applies to all EU citizens. It doesn't matter if the citizen is accessing the web site from the eu or another country. Blocking people in the EU doesn't block all eu citizens from accessing your product/service.
Recital 23 (referring to Article 3, Territorial Scope)
> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.
An attempt to prevent EU users from accessing the site at all is about as strong a signal as it gets regarding this. When you're blocking all of Europe by IP, it's pretty fucking obvious you're not envisaging offering services there.
It's a basic idea, and HN prides itself on being smart, but there aren't global laws. No one gets to enforce civil penalties outside of their jurisdictions, without exceptional circumstances. If they fine you and you don't have offices there just ... don't pay? The EU might not exist in 10 years anyway.
An expat living in the EU is protected because they reside in the EU. If you are living in the USA, you must follow American laws.