The risk is not "being punished under a new law for things your business did before the law existed". The risk is "there's a new law that made your whole business model illegal, now what?"
A law like this seems pretty much impossible to enforce, though. Even if it turns out that GPT is just parroting remixes of GPL code, all examples of generated code I've seen are fully indistinguishable from code someone may have come up on their own - with the exception of contrived cases where someone is actively trying to get it to output a particular fragment of code verbatim.