Nobody will fine an open-source project that amount of money. The goal of GDPR is not to bankrupt anybody but to nudge them into compliance. If you aren't maliciously handling user data, you are not a target of high fines.
Then why does the law not have this an an exemption?
Have what as an exemption? Not applying GDPR to small-time open source projects? Being open source doesn't suddenly make it fine to mishandle users' information.
GDPR has exemptions built in but being open source project is not one.