I think it partly has to do with what level of security is around you, I don't live in a place (Denmark) where I have to solve that many other people's basic needs so I can optimize further up in the pyramid of needs.
I think congrats are in order, he did not get distracted with a minor part of the market but is focused on delivering value to the bigger market. He can always add more clients later.
There are positive and negative impacts of GDPR. Yes, poorly implemented consent is annoying, but forcing companies to use time and energy on privacy is super positive.
I have spent the last nine months in a few different co-working spaces here in Denmark, and all startups there have informed and essential conversations about handling users data. Just a few years ago that would never have been a topic. For me that's a very positive change.
It depends on what kind of company you want to build.
Yes if your goal is to build a Dropbox, an Instagram etc then you don't have "product-market fit" before you have to stay up all night weeks in a row to keep your service alive.
Background: I have build a VC backed company that ended up on a linear growth curve and enjoyed it a lot, today the company is profitable and proud. Today I am VP Growth of a heavily VC backed company that is trying to hit product-market fit.