You are slightly wrong. The GDPR applies to everyone dealing with personal data on the regular, which you always have to assume with open text boxes. There have been plenty rulings already imposing fines on individual, private citizens for their misconduct in violation of the gdpr.

While Lemmy as a system might be exempt, anyone running Lemmy for sure isn’t, as long as it regularly processes data of EU citizens, which it does.

As for the devs, the gdpr does require privacy by design. One could argue the Devs themselves aren’t running it at all, so their software doesn’t have to adhere to it, but individual instance hosts could still be hit with fines for running it as is.