European courts and regulatory agencies are not run by gibbering morons. They do not levy multimillion dollar fines against small businesses for making honest mistakes. Art. 83(1) of the GDPR explicitly states that fines must be proportionate. Art. 83(2) states that fines must take into account the number of subjects affected, the level of damage suffered, the intentional or negligent character of the infringement, action taken to mitigate the breach, previous breaches and any other aggravating or mitigating factors.

The GDPR replaces the Data Protection Directive, which left the levels of penalty to the discretion of individual member states. In the UK, the maximum fine for a breach of the Data Protection Act (the British implementation of the DPD) is £500,000. You can see a full list of enforcement action taken by the Information Commissioner's Office at the link below. I defy you to find a single example of a monetary penalty that was disproportionate.

https://ico.org.uk/action-weve-taken/enforcement/