Wasn't there concern that they would target small companies and thus stifle the innovation? Seems like a win-win to me.

Please bring your actual argument instead of insinuating stuff.

Anyway, the EU's reasons seem to be entirely legitimate to me.

There is censorship of illegal streaming sites crippling the internet (Cloudflare). People are being freightened from illegal iptv boxes to watch free sports because it could be part of a botnet or residential proxy network. There are million or billion euro fines for social media and service providers like google. There is enforcement against "fast fashion". Yet there is zero effort for iot privacy, not even labels or certification for good devices.

I don't want to be cynical but face it, the EU really only cares about things that generate money for themselves or big internal market players under the disguise of consumer safety and privacy. Obviously that also comes with some good effects but the perverse incentives are enormous from which we must not be blinded by ideology and warm feelings of our politicians being good and working for the people and the common good.

I have lots of criticisms of the EU and the censorship is lamentable, but this sounds like whataboutism to me. The EU does more for certification than other governments, but even they can't do everything. Is the US going against any of these things? It is only reasonable that they go for the large players first and foremost. Yes, they should do even more, but even the EU has its limits. And I'm quite in favour of going after fast fashion.

It is whataboutism, and it's also wrong because GP seems to think the cases covered in big media are all that's being enforced. It's much more, as pointed out in a comment below: https://www.enforcementtracker.com/

CMS has a public tracker of GDPR fines (https://www.enforcementtracker.com/) listing over 3000 cases, most are companies HN readers have not heard of.