It doesn't matter where you are based (as a company, if this is what you meant), it matters where you operate, and lots of countries are regulated (not only Western - which in many cases are not, incl. many US states). There are basically three types of markets: regulated, gray (not regulated, not forbidden) and black (forbidden). Different companies operate in different markets, depending on their strategy (and level of shadiness). Payment processing (deposits & payouts) is done using external providers (as many as possible to serve different countries), and there are quite a lot of regulations regarding money laundering, politically exposed people and so on that they have to comply with, both for gambling regulations and international laws (e.g., European laws are quite strict when it comes to AML).

Obviously you may have customers from a regulated country without "operating" there, which means advertising, offering the site in their language, etc. But, when you withdraw money identity verification is necessary, and companies can be fined (or worse) if they willingly retain customers from regulated markets without the local license.

So yeah, there are companies that do shady stuff, but mostly it depends on country regulations. The company I worked for targeted Nordic Europe (mix of gray and regulated markets) and South America (mostly gray markets, on the way to be regulated), for example. Usually gaming authorities are quite keen in collecting their taxes, so they tend to be quite active in pursuing those who violate their regulations (like if you decide to operate where you can't).