Mark one for another American conundrum: having so much distrust for "the man" while at the same time being completely oblivious to the amount of personal data being skimmed off their daily activities. But it's all to guarantee Freedom™ so it must be ok?

Your tone implies disagreement but that's exactly what I want as part of the treaty.

But is "Wait for a possible but incredibly unlikely series of events to occur" really a solution?

Both were illegal because they did not address the core issue. The EU commission (representing EU country governments) is more business driven and wants it to work, so they created Safe Harbour etc. They also drove the standard clauses which are illegal too (or better: If as an EU company you sign them, it's your responsibility to make sure the US three letter agencies do not access the data of your customers, good luck with that).

The EU parliament have the people in mind, so they don't think it works and drove the GDPR. The EU courts look at the law and see it's not possible to create contracts, so shot down Safe Harbour and Privacy Shields. The EU courts say standard clauses could work in principle, but see above.

How does this hinder an EU startup to expand to the US?