In fact, it's not even legal residency that matters. You must simply be present in the territory that the regulations apply to (EU+EEA). If you're not, then the protections don't apply to you, regardless of your citizenship.
Yes, unless the company is itself in the EU, in which case the GDPR always applies, even if you're not a citizen, resident or even visitor to the EU.
In fact, it's not even legal residency that matters. You must simply be present in the territory that the regulations apply to (EU+EEA). If you're not, then the protections don't apply to you, regardless of your citizenship.