That’s one guy in one case (that was eventually dismissed). There are probably a few handfuls of other examples you can post here. It doesn't hold a candle to the millions of people and businesses liable under the GDPR who face a nasty framework of foreign laws with no limits on fines other than $10/20 million.
The guy committed an "US crime" in Russia, where what he did was not illegal. He arrived on US soil, where he committed no crime.
He was still arrested and charged.