Appropriate means running a risk assessment and deciding accordingly

The risk assessment doesn’t require the company to assess the reliability of international diplomatic relationships. Having your data on EU soil (even under the care of a US company) is enough for compliance.