>If you can afford the specific set of qualified lawyers (up to a ridiculous, plutocratic limit the likes of e.g. Google breach), you can legally offload the risks to an offshore server.

You can't. GDPR also applies to processing EU residents' PII outside of the EU.