I think a bunch of them took the "if audited we will probably be screwed unless the enforcing body takes leniency on us" and just kept on going. It opens up everyone to another huge liability but that's business. DPOs only have so many staff to investigate complaints.