What matters is where you're currently located, not what citizenships you hold. Refer to GDPR Article 3, Territorial Scope. There is no mention of citizenship, only whether the subject is "in the Union". It's no different than how laws work in the physical world: you are protected by, and abide by, the laws of the country you're presently located in, not the country you were born in.
Hypothetically, how would a friend who lives in the US and happens to still be EU citizen be able to sue for GDPR violation? would there be any financial benefit involved?
They would only be able to sue if the processing occurred in the EU, according to the national law of the country where the processing occurred. Citizenship is not relevant; a U.S. citizen is entitled to the same benefit.