It’s really annoying, but even if Cloudflare/AWS etc. offer a big “block all access from abroad/evil GDPR abroad/…”, I feel like the site owner is still the one to blame for pressing it.