The problem is really that the indie developer doesn't really have any monetisation options other than those which break the law, but in theory it's not overly onerous to pick one that at least claims to be GDPR compliant. They should be able to trust that their suppliers aren't providing them illegal products tbh.