They are AFAIK, but can be exempt of articles 12 to 22 under national law. What did I miss?
Article 4 of the Treaty on European Union states that "competences not conferred upon the Union in the Treaties remain with the Member States" and "[i]n particular, national security remains the sole responsibility of each Member State".
Article 2(2) of the GDPR states that "This Regulation does not apply to the processing of personal data [] in the course of an activity which falls outside the scope of Union law".
Article 3(3) of the LED includes similar text (with the word "Directive" replacing the word "Regulation").
GDPR doesn't apply to EU activities related to foreign policy or law enforcement, but EUCFR articles 7 and 8 still apply, as does regulation 2018/1725 for the former, and directive 2016/680 for the latter–so in theory, some activities are indeed exempted from GDPR, in practice, they're still subject to data protection laws that require essentially the same measures as GDPR.
Source: GDPR article 2 and 6. On a more personal note, I've already requested my data under GDPR, cited WP29/EDPB guidelines, and filed complaints against various govt agencies.