If no federal law exists on that subject, then yes, that's how the Supremacy Clause works. However, an existing federal law preempts state regulations.

As an example, let's say Congress deemed fidget spinners a serious hazard to society. Congress can take two broad approaches to deal with them: (1) regulate, or (2) ban. In the first case, any state laws regulating fidget spinners could theoretically continue to exist, so long as those laws do not conflict with the federal laws and states are allowed to have additional regulations beyond those federal. In the second case, those laws become moot, as fidget spinners are not allowed.

Another reason why this works can be seen in the dynamics of data control laws like the HIPAA, COPPA, and CCPA (they're not privacy laws but data control). If you are an entity operating in the US covered under HIPAA or COPAA, it doesn't matter if your corporate headquarters are in California or Delaware; you must comply with those laws. With the CCPA, California decided that it wanted additional data control laws in the vein of the EU's GDPR, and that's their right because (1) no existing broad-scale federal data control law currently exists and (2) the Constitution does not give Congress the exclusive power to regulate data flows.