You've asked two distinct, but related, questions:
Even if you were never in a country, can you be charged with breaking their laws? and,
If you are convicted of breaking their laws, can they punish you?
To take your example:
First, whether the Saudis could charge you for breaking their laws depends on the extraterritoriality or extraterritorial jurisdiction of their cyber-law. As the name says, extraterritoriality deals with whether a country's law applies outside its borders. Whether a law is extraterritorial depends on the specific law and country. For example, American courts are guided by the presumption of territoriality, that unless a statute explicitly says otherwise, statutes apply only inside the country. Because many hackers and other cyber-criminals are never physically in the same country as their victims, cyber-law often applies extraterritorially.
Second, whether, once charged, you could be tried without being in the country, also depends on the country. In many countries, people can be tried in absentia, (without being at the trial) so it is possible the Saudis could convict you without you going to Saudi Arabia.
Finally, punishment is not extraterritorial -- you must be in the country that convicted you to be punished. As Lag points out, it seems clear could extradite you. Extradition is the legal process of sending someone accused or convicted of a crime in another country back to that country for trial or punishment. Extradition is covered by treaties. For various reasons, many countries do not have extradition treaties with the Saudis, although as a practical matter, your government may choose to cooperate with the Saudis.
(The case of Jamal Khashoggi suggests the Saudis may have a different understanding of extraterritorial jurisdiction.)