>There's a real risk of getting sued / getting cease and desist letters from predatory law firms who aim to collect fees for small mistakes in your privacy policy.

What do you base that assesment on? GDPR mostly just consolidates multiple privacy laws into one.