"Lemmy" (the software) doesn't have any data. It all resides on servers owned by people other than Lemmy's developers. They have the user data and would absolutely be subject to GDPR.
Again, no matter what Lemmy's devs put in place, it doesn't matter because the instance admins can do whatever they want.
It's perfectly stable. Linux just generally attracts people who like to tinker and tweak things, in particular because it's much easier to do and gives you a lot of power and flexibility in making the machine your own.
My laptop running Arch Linux has remained problem-free for the last 6 years or so since I installed it.