Doesn't matter if they're from the EU or not. If you target (people in) the EU, the GDPR applies, no matter where you're from. Whether the GDPR can be effectively enforced is another question of course.
Not true, the GDPR only applies if you do business with the EU. There are some companies that have decided to become "GDPR Compliant" that are outside of the EU, but they don't really need to.