This would be true if they were working from a baremetal Apache server. But they seem to be using a vendor, Cloudflare, for their CDN. And so I strongly suspect that they used their existing Cloudflare account to do it. Just type the countries you want to block into a field in the Cloudflare UI and you're done. I've used that UI myself (not for GPDR reasons but for compliance with my countries sanctions). Significantly easier than controlling the cookies and data retention and getting an audit to certify compliance, which I've also done.

I've been in meetings where this was discussed.

"It's just a checkbox in cloudflare to not show up there" is so effortless that you need a compelling reason to ignore how easy it is.

And if you don't already have traffic analysis showing that 30% of your readers and thus 30% of your ad revenue is coming from the European continent... You spend the 45 seconds it takes to find the check box and you click. Then worrying about maybe possibly getting screwed by some far away legal something or other is irrelevant.

The GDPR is an overreach as evidenced by the OP kvetching about why a foreign country does not comply with his country’s regulations regarding cookie use.

What’s the corollary for the patriot act? AFAIK, its provisions would only affect immigration and travel, which happen inside a country’s borders.