1. Most sites are blatantly non compliant, see opt-outs (presets). For example if someone from covered regions does a search on Google right now it presents them with 2 buttons, 'I agree' and 'See more', the former is pre-checked to enable tracking everything, the latter leads into a labyrinth of settings. Not even an opt-out everything is presented (itself non compliant, but still). It is presented everytime, unless they sign up for a Google Account and/or download their browser extension.
This is definitely not how private by default should work.
2. The EU created a stick big enough in theory to go after anyone, yet they refuse to do so for years. Indeed, we are probably interpreting those numbers differently. They are a slap on the wrist at best and anchoring the discussion at the wrong point. For example in the above case the potential fines for Google could be up to ~$6B yet the listings do not add up to $60M, that's two orders of magnitude.
As it stands, GDPR achieved very little so far to protect the average user. Tracking is as bad and invasive as it has been for years.
It was adopted 4 years ago, enforceable for the past 2 years. Still every single site that even cares about showing a nagbox offers only opt-outs. Those numbers listed are a joke compared to the 4% worldwide revenue stick. What's the point of the big words if we are not prepared to back them up?