ICO was not established by GDPR. It has been around since 1984, and was also the agency responsible for enforcing GDPR's predecessors.

I agree that a regulatory agency specialized to these issues would increase their importance, but it's not the whole solution. ICO already existed, it just didn't have teeth.