the thing is "We don't want to get legal advice" is a ridiculous justification for acting on legal advice

I'm sure they (or whoever sells the product they use to publish) did get legal advice, of the "what is the cheapest way to ensure this isn't an issue for us" and the response was "block 'em all, let God VPN them out."

After all, using a VPN doesn't absolve companies of the GDPR.