You're absolutely right! GDPR is in no way, shape, form, or manner meant to be cost-neutral. Your point about bank robbers is well-taken.

However, is it possible that in a context where companies are weighing the cost of GDPR compliance against the benefits of GDPR compliance (i.e., keeping their EU business) some might come down on the side of jettisoning the EU business? They might even opt to do it by using a tool, like Cloudflare Workers, that they can convince to block everyone in the EU.

You would be absolutely, completely, 100% right to consider this fully in line with the intentions of GDPR. Protect privacy or GTFO, right?

If companies find it too onerous to do business in the EU I am sure others will happily fill that gap, so I am not worried. A lot of polluters probably also went out of business once environmental regulations got tightened.

You're right! I'm also sure others will happily try!

With that said, it's possible that a fragmented market with fewer legal business models may not be as conducive an environment to all possible businesses. It's even possible that as a result, not all gaps will get filled.

Personally I think it's healthier to have a fragmented market. Maybe it's not as efficient but fragmentation makes it more possible for smaller companies to find a niche. Otherwise big companies like Amazon, Facebook and others monopolize business world wide.

Different legal models also provide grounds for experimentation. Who knows what works better in the long run? Wild West or regulation like GDPR? We don't know.

Sometimes a fragmented market just means everyone has the same problem and nobody can solve it profitably at a price that works for most. Then things just suck for everyone.

Which is to say that you could be right! Absolutely and completely! Or you could be really wrong. Time will tell. The economic history of protectionism could be read by some to provide some clues, though.