Yes, everyone wanting to serve clients in the eu (even if they are on vacation in non eu) must comply with the gdpr; this article however is not related to the gdpr though.

GDPR is about not storing information about people without their consent and has nothing to do with the encryption legislation.

Make no mistake I would never use Threema, and "made in switzerland" is usually just putting lipstick on a pig; the one time someone seriously looked into Threema it was full of weird decisions, if I remember correctly

Still GDPR is unrelated to what we are talking about