I assumed that California couldn't issue fines against a company unless the company is based within its borders. Every app is de facto international nowadays, so does that mean California can issue fines against any company with a popular app? I'm rather ignorant of the legal dynamics in play here, so it'd be wonderful to hear from someone with experience.

California isn't issuing fines, San Francisco is. And, yes, either can issue fines to a company irrespective of where its headquarters is located, though its ability to actually collect fines may be limited.

OTOH, any company doing business in the San Francisco probably has assets or income streams that are going to be subject to the jurisdiction of courts through which either the City and County of San Francisco or the State of California could act to enforce fines.