The other side of this is that the GDPR puts all those companies from jurisdictions with no privacy regulations to speak of in front of a choice to either stop doing business with a huge market or actually stop ignoring privacy concerns.

The important consequence of this is that it puts EU startups on more equal footing than in the past. Most EU countries already had fairly solid privacy regulations, some more, some less, but certainly more than the US (generalization, but that's the trend). If you were a company from a different jurisdiction, you could mostly skirt those regulations (up to a point) because they weren't enforced in most cases. Not so much if the regulation is from your home country.

With GDPR, actual EU startups now play by the same rules as non-EU companies who do business in the EU. If a US startup wants to be international, they'll have to compete with EU startups on a more level playing field now.