Only if they somehow directly got it from GP, through some kind of commercial thing. I doubt downloading stuff from Github for personal use qualifies.

The way I read it, this directive wants to ensure that for any digital product sold on the EU market, there exist some entity that can be sued in EU jurisdiction; within the Union, that would be the vendor; outside - a vendor representative, or an importer. Which is a perfectly reasonable expectation to have, and it's how it mostly works with physical goods and services (aliexpress notwithstanding).