That’s the point: if you can’t profit off my personal data while simultaneously protecting it as a “low margin,” your business doesn’t need to exist. Fines relative to revenue hurt every business a lot, which is how it should be. A massive data breach should be cause for going out of business, not “oh, we’re taking X% of your profits this year, but we totally trust you to do better next year.”