They're only subject to large fines if those laws are in place and actually being enforced, though. Companies keep getting away with these huge data breaches in the United States with almost no real consequences.
I think we'll see a national privacy law in the United States at some point in the next five years. There's appetite for it in both major parties (Democrats to protect bodily autonomy, Republicans to stick it to Big Tech), and I think the targets of the regulations themselves will at some point lobby for a consistent national law rather than the patchwork of state laws that we have now.