The EU has jurisdiction over EU citizens.
In the case of GDPR compliance it is trickier because you can easily end up doing business with entities that will never be in the EU, so while the EU might think their laws apply worldwide, the extent to which you “have” EU rights as an EU citizen in any enforceable way is questionable.
Apple wants to do business in the EU, so the EU can write whatever laws they want, including laws that govern Apple’s worldwide behavior.
I think this is a bad way to write a law, because if no court that I care about is going to enforce it, I can violate it. So, it is misleading to the citizens of the EU to say that they are protected by these laws.