Because it's not for you to pick and choose which laws you wish to follow. If a firm starts in the third world, it also likely cannot handle the regulatory burden of gdpr.

For what it's worth, it would only have to be out side Europe. If a firm has no office in Europe, it would be difficult for Europe to enforce its laws. Extradition requires it be a crime in both countries.