> The problem is what happens if a legal firm or an agency targets you.

Nothing. GDPR enforcement is carried out by each country's regulatory authority; they're the only ones who can sue, target or take action against you for non-conformity.