They can be! You can build GDPR compliant apps with Expo if you follow the requirements.
While Expo ensures the proper handling and processing of developer data and end-user data, we cannot guarantee that the developers who build apps with Expo follow similar data privacy practices themselves.
For more information about GDPR, see European Commission's data protection page.