I'm sure they (or whoever sells the product they use to publish) did get legal advice, of the "what is the cheapest way to ensure this isn't an issue for us" and the response was "block 'em all, let God VPN them out."

After all, using a VPN doesn't absolve companies of the GDPR.

Yes so the informed choice they made was "block gdpr countries" vs "be transparent about our use of personal data".

Every site that gdpr-blocks itself is saying that they intend to extract value from your data and they don't want to tell you how.