That's a gross generalization. In fact, the parent explained quite well why GDPR can become a problem for smaller companies.

It's not the law itself that matters in this case but the clients' (quite possibly wrong) interpretation of that law. As of now, GDPR unfortunately leaves a lot of room for interpretation.