Not a lawyer, but honestly, both of these takes are probably not correct.

I'd say that most fedi-services fall more into the 'can I make someone delete an email' GDPR category (tldr: probably not, but maybe) with a dose of the 'this service is for personal/non-commercial use and includes messaging and social media' exemption.

This of course won't work if you're taking money or doing commercial activity but at that point you're a business and should consult your lawyers to ensure your compliance. (And if you can't, then maybe don't be in that business.)

I wouldn't want to be the one to spend the billion dollars to litigate that, but frankly if you're not in the EU, and not a business, then the person demanding removal would have to take you to court to force compliance (assuming you didn't just do it so you don't have to deal with a grumpy person) which is... unlikely.

The much more horrifying interpretation is that the data controller, processor, and sub-processor language comes into effect and everyone needs to sign written agreements with every other fediserver to be even remotely in compliance.