Note that the regulation talks about where the requester is, not where they report to be.

Some legitimate experts have concluded that this wording allows someone in the EU using a vpn they reports them as coming from outside the EU to be covered.

That seems like a low risk incident to me, but I’m not a lawyer & I can see where that interpretation comes from.