> ”but the GDPR explicitly spells out that the controller or processor, even if not established in the EU, is subject to GDPR”

It may be in the GDPR’s text but they have no jurisdiction. Put simply, the EU has no authority whatsoever to create law outside of its own borders.

To instrument with which to extend the reach of such laws as the GDPR would be international treaties.