National level site blocking, suspension on any future operations, international courts... Corporations are much easier to persecute over borders than private persons.
Why do you think American companies, even ones with no legal presence in Europe, still went along with GDPR? Same principle applies here.