It's a common misconception, and has been widely reported even in the mainstream media. FYI it's Article 3 of the GDPR that specifies the territorial scope authoritatively.

Fun fact: The word "citizen" doesn't actually appear in the GDPR at all.