€10M is not the lower bound in penalties. It's the upper bound for breaches of data protection obligations (except for very large companies, with turnover >€500M/y).
https://gdpr-info.eu/art-83-gdpr/
"Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:"
So then why not just set it to a percent of revenue? If you're just going to slap a small company with minimal turnover with €1k fines anyway, then why the need for the "up to €10M" amount?
Depending on how quickly regulators can act, and how they would determine the date of precedence for 'the preceeding financial year', it's just about conceivable that a company might have >1 year of warning to do some financial trickery to minimise their fines.
Having a range(0..max($turnover_amount, $fixed_amount)) reduces the scope for that sort of trickery.