I might be wrong but the impression is that every US company tries the same, with different rates of success, And I don't only mean SaaS companies, or even IT. And I also don't mean unknowingly, but actively trying to impose their usual ways.

I still find it confusing that you can both claim to be GDPR compliant and also that only US law apply to your operations. Automattic was also claiming compliance via the EU-US Privacy Shield which had already been made invalid by the European Court of Justice for a while.