So we has just established that not only hardware companies are at risk. Good.
Now, step two: US trolls will not sue a company doing business outside of US; too much trouble. But any company doing business in US is a subject to local laws, and most SaaS companies want to work on US market simply because it is the biggest one.
"Doing business in US" means, among other things, having US customers and using US payment processors.
Getting an injunction against a company outside the USA for software running outside the USA is not within the claimed jurisdiction of US patent laws.