If a citizen of France in the EU calls on the phone a citizen in China to buy something, the Chinese citizen isn't subject to EU laws. However, the Chinese citizen AND the French citizen is subject to Chinese laws, and the French citizen is also subject to French laws. Plus there's a plethora of international trade agreements.
This is where everything starts becoming strange, because in the case of the GDPR it's an attempt to subject the Chinese citizen to a law from the EU. I.e. this is a debate over sovereignty, the EU citizen should be responsible for conducting their business not the Chinese citizen.
(a) The Chinese citizen never left China
(b) The Chinese citizen never intended to leave China
(c) The Chinese citizen doesn't know the laws of the EU, because they aren't there
(d) The Chinese citizen conducted business in China, because the transaction occurred there (i.e. the money was transferred to the China) <- This is the rub, because where a transaction occurred is actually defined differently in each country
It's basically arguing that the business is responsible for following laws in a place it does not conduct business. It's out of the EU jurisdiction. I'd love to see an entirely U.S. (probably only collecting in USD) based company getting "fined" in a country it doesn't conduct business.
In this case I believe @jahewson is correct. They just can't legally _punish_ you for violations until you enter the EU. You've still broken the law in the EU by not handling the data of a EU citizen as legally required by anyone who does business with them.
I understand where you're coming from, and that very much _was_ the way things used to work. The new law changes that. It governs interactions with EU citizens regardless of where they are.