“Not much harder” for the technical person
maybe, but for the nontechnical person who doesn’t even know what information their software stores or for how long much less the requirements to appease GDPR, it’s much easier to block and get on with life especially considering what little legitimate EU-originating traffic their site probably received when the decision to geoblock was made.
How does a nontechnical user with little knowledge of GDPR know if he needs to display a cookie popup (he may not even know what a cookie is or whether or not his software uses them or in what capacity). What about email addresses in user accounts? Is he now collecting private information and making himself culpable for expunging that information on request? He may not even know how to expunge in the case of log files or other artifacts. “Not much harder” my arse.