Well, GDPR is not actually a law, but a framework that must be used by EU member states to implement their own laws. That may be one cause of local enforcement being not fully aligned with GDPR.

But yes, the local GDPR laws do seem to be intentionally underspecified, like you said.