And what exactly stops this from happening to any company or organization, regardless of being US-based?

If 90% of customers are in the US, they're probably going to comply.