Clearly it is not true that there are no downsides, because those companies had to change behaviours and offer more data protections as a result. The goal of GDPR is not to bankrupt companies, but to fix behaviours.

I do agree fines take too long to come and are too small.