Your understanding is correct, but my point is that inherently if US people can access EU profiles inherently some EU data will be stored in the US.

It would then been trivial for someone to crawl EU pages and rebuild the corpus of data.

The only real solution is to firewall off regions and prevent those users from accessing anything other than their own.

This is already what some countries like China do, for instance