The SaaS founders are blocking their Russian customers

If the customer is an individual that may also be unlawful racial discrimination as the definition, at least the EU/UK, includes nationality.

Now, suing a company in a foreign country is no walk in the park.

Most TOS have room for cancellation by the vendor. They could also refuse to renew their service. Customers could try going to court maybe?

GDPR is for the EU, which Russia is not a part of, so it doesn't apply. Even so, GDPR allows for monitoring IP addresses, for example to ban an abusive IP.

GDPR applies to EU citizens and residents and I don't think it prevents tracking for the purpose of blocking.