>I believe he does have a cop-out if HN isn't selling to or marketed towards the EU

Nope, GDPR attaches regardless of whether you market in the EU/to EU residents, as long as you provide goods or services to people in the EU you're beholden to their rules.

Theoretically, a company that only offers services to US residents (mortgage/banking/legal) could still be beholden to GDPR, since their cardholders might access their website (i.e. be provided services) while in Europe, though as far as I know it's never been tested in court.