What is it's a small company, perhaps even a single person company? Punishing them would have a disproportionally greater negative effect on their livelihood than it would for the people in charge of the company ordering the illegal thing to be built.
You mean, a company in the business of selling cookie banners that are deliberately in violation of regulations, should be spared because its owner needs to eat? I can't see why anyone would have that sympathy.
I'm arguing against going after small business contractors implementing stuff that is deliberately in violation of regulations and instead going after the large business that is ordering such an implementation.