You know that the GDPR violation fines start at 10m or 2% of worldwide revenue, whichever is higher, right?

These are up to limits, not start at. The second class is 20 million/4%, but still up to. And given the long list of factors to consider for the fining authority, they can't just slap close-to-max amounts around without supporting evidence for why that's appropriate.