> we have GDPR in order to punish intentional bad behavior, not to prosecute incompetence

Nope. It is to protect users.

Users are harmed by both intentional bad behaviour and incompetence. This is the same principle as strict liability for product faults.