Proving this can be expensive and is risky. Who knows what any individual judge in any EU country will decide is "reasonable"?
Companies can easily be destroyed by filing multiple charges against them. Guilt, innocence, or reasonableness doesn't come into it: the process is the punishment.
Look at Amanda Knox (Americans tend to think she's innocent, Brits tend to think she's guilty) - after appeals the Italian Justice System found her not guilty of the murder of her roommate. She still spent almost four years in prison in her early twenties and had to spend a huge amount of money on lawyers to arrive at this result. Just because you eventually get what you see as the right result doesn't mean you won't go through hell to get there.
A major reason why Americans are having such a big problem with GDPR is because the EU system appears to change its interpretations and decisions abruptly, with retrospective effect. You set up companies in certain jurisdictions thanks to their tax rates and how transactions are treated. You follow every aspect of national and EU law. These arrangements are widely known, are accepted as legitimate practice, and they continue for decades. The EU commissioners change - suddenly your corporate arrangements are wildly illegal and you are subject to penalties and back taxes stretching over a decade.
If staff changes and they say that they will interpret a rule differently going forward, you can adjust your behavior to comply. New legislation, sure abide by it. But when the rules change and your behavior 15 years ago is now viewed to be illegal you can't do anything. Retroactivity is accepted in Europe but it is explicitly unconstitutional in the US. It's a major reason why the US is not currently part of the UK.
So the GDPR is terrifying because of the massive discretion granted to judges and prosecutors in every EU country and their habit for changing their interpretations. On its face it's not too threatening, but the fines are massive, there are no hard rules, and you can't be sure that today's interpretation will be tomorrow's.
Facebook and Google will manage - they can write billion dollar checks and get the US government to protect them. Many of us can be completely wiped out by a $20MM fine. Just a court case would be existentially threatening in terms of the resources it requires and its impact on fundraising and gaining customers.