Facebook still operates as a business in the EU and can therefore be fined there. As a similar example, Google was fined €50 million earlier this year as a result of a GDPR violation.
Can Facebook be fined by the EU for actions outside the EU that only affect users outside the EU? Sure, but it would likely create political waves and I'd doubt it'd happen. Global enforcement of GDPR isn't realistic, as the EU doesn't have worldwide jurisdiction.