You forgot about the best part, in terms of the “GDPR threat” effectiveness:

Fines can be up to €20 million or 4% of global revenues…, _whichever is greater._

The actual fines under GDPR aren't a huge deal. There are companies who get fined over and over and over and over again year after year after year. It's not running them out of business, it's just cost of business.