Looking at all the documented (not that many) large GDPR fines, I haven't noticed any that are the result of a company (much less a developer) accidentally 'fucking up' - they are all the result of an intentional policy or an unethical management decision intentionally screwing people.

If you simply fuck up during your development, the most you'll get in practice is a letter from the regulator requiring you to change the fucked up thing; Fines arrive when management refuses to change the fucked up thing and tries to invent a loophole instead.