> Another more plausible scenario is countries simply start repealing safe harbor laws.

It already happened via GDPR to some degree. CJEU ruled in December that platforms can qualify as controllers for personal data published in user-generated advertisement. The given reasoning was basically that the platform determined the means and the purposes of the processing.

Due to that they can be liable for article 82 damages.