The hope is they levy few fines. When you want to make money you set the fines such that they are "a cost of doing business". Most often you don't even call them fines, you call them a permit/license fee (though fines are also common). When you want to prevent a behavior you make the costs high enough that it is worth the effort to not pay them in the first place.

(I'm assuming here that 10% is high enough that nobody would call it a cost of doing business - I could be wrong)

Yeah neither intent nor gross negligence is the reason most data breaches occur

Hopefully, this raises the bar then.