> Certainly, calling out poor security practices is a good thing, however this level of scrutiny is going to require a major shift in mentality for a large portion of the industry.

That's the point. "A major shift in mentality for a large portion of the industry" is basically GDPR's success criteria.