I think you're making the mistake of thinking the fines mentioned are the minimum fines, when they're the maximum possible fines for the worst repeat deliberate violations.

EU regulators tend not to apply fines for companies making simple mistakes. They do want the companies to come back into compliance.

If small businesses don't have manpower or money to handle user's information transparently, they should not collect those information in the first place. That's why I like GDPR.

For SMBs that probably is really bad. Just the fact that a small website you’ve just heard about requires a lot of your data would be negative for their customer acquisition, while other people would continue trust major companies.