What do you mean what law? See the court case, they've issued it and so they can either pay it or see what Italy wants to do about it

If you get a speeding ticket in North Korea and fly off before it arrives at the car rental, you can ask what law the rental is going to use to get the money from you abroad. You can not pay and choose to never visit the country again. In Cloudflare's case, however, they probably want to continue doing business in that market so just fleeing with the money is not likely the most profitable option for them

There's tons of international cases if you want to know more. It's also a common (to the point of trite) discussion point about GDPR saying it applies globally. Obviously it doesn't unless the non-treaty country lets an EU/EEA country enforce it (I am not aware that this ever happened) if the fined party does not care to continue doing business in the EEA