No they can't. That says only about where the law applies, it doesn't say about prosecution of entities not residing in the EU. EU's legal arm can't extent outside the boarders of the EU, without an outright military invasion, it's toothless to foreign entities.

>So the GDPR applies.

I never said it doesn't apply. I said how is the EU gonna prosecute an entity that doesn't reside in the EU?

Extraditions are tough to negotiate even for serious stuff like murder. No foreign judge will take GDPR violations seriously to do that.