The National Security Law is extraterritorial. Hosting outside of Hong Kong means nothing.
Hosting outside of Hong Kong is important. Hong Kong can't impound the servers if they're outside the territory, without the cooperation of the server owner/operator or the government where it resides.
Of course, if the owner/operator has employees or assets in Hong Kong, those could be held to elicit cooperation.
It matters a bit, but not that much. Failure to comply comes with a maximum fine of HK$100,000 (US$ 12,500), plus six months imprisonment for service providers. [0]
If HK police repeatedly fine a company, the company may have to stop serving HK or even China.
[0] https://news.rthk.hk/rthk/en/component/k2/1536151-20200706.h...
I think Canada suspended their extradition treaty to protect against this threat.
Companies still serving to HK might be screwed anyway.
I was saying that wrt companies who had infra in HK which was serving traffic outside HK. It might make sense to not keep that in HK anymore.
Additionally many western companies have their offices in Hong Kong. Does this mean any privileged access that these offices/employees had with data is also now susceptible.