From the privacy policy:

"If you are located in the European Economic Area (“EEA”) or Switzerland, with respect to transfers to the U.S. of certain personal information collected in connection with your use of Samsung Smart TVs, Samsung Electronics America, Inc. and its subsidiary Samsung Research America, Inc. are certified under the EU-U.S. and Swiss-U.S. Privacy Shield frameworks developed by the U.S. Department of Commerce, and the European Commission and Swiss Federal Data Protection and Information Commissioner, respectively, regarding the transfer of certain personal information from the EEA and Switzerland to the U.S."

Which basically means that Samsung pinkie swears that they won’t do anything bad, and the EU is powerless to do anything anyway.

I don't understand how this works.

If you're not in the EU, the EU doesn't have jurisdiction, period. They can say whatever they want but it doesn't mean anything. I'm sure China would love to enforce their laws worldwide too, but it doesn't work that way.

China does try and succeed, I’d like to remind you of the NBA fiasco and the Blizzard catastrophe.

Tell that to the US and US tax laws

Those are enforceable via extradition treaty because tax evasion is a crime in every nation in the world; if you want to extradite someone, the act in question must usually be a crime in both nations. The GDPR imposes regulations which have not parallels in other nations, so extradition is not an option. The Europeans are, however, free to arrest those who enter their nations, so it's still worth following for most people.

In case with Samsung, EU authorities can forbid selling their products in EU.

If you want to do business in, or travel to, the EU, then you obey their laws.

You’re free to ignore the GDPR but don’t be surprised if they arrest you if you ever visit.

Legally it does