In that example the goods stolen are tangible and have real, solid value that anybody can recognize.

In the case of things covered by GDPR the value is opaque and intangible, and only valuable to certain people. Letting 'the free hand of the market, driven by the layman who doesn't understand this, is not effective.

If you want proof, well, it's in the pudding.

Edit: also, if banks wheew getting knocked over as much as sites and apps, the government would intervene