Because it's not for you to pick and choose which laws you wish to follow. If a firm starts in the third world, it also likely cannot handle the regulatory burden of gdpr.
For what it's worth, it would only have to be out side Europe. If a firm has no office in Europe, it would be difficult for Europe to enforce its laws. Extradition requires it be a crime in both countries.
Why lump privacy protections together with upload filters as if they're both bad. If you service doesn't abide by the GDPR, I'd try to avoid it. On the other hand, upload filters are a disaster and not at all comparable to GDPR, not in terms of what they do to the end-user, not the burden they place on service providers.