You can just break the law, if you don't get caught, especially if you're rich.

They can just not do it in Europe and keep doing it everywhere else

Profiling visitor traffic to protect against abuse is a legitimate use case, even for GDPR. It's only a violation if that usage is not disclosed in the ToS.