They'd only do it as long as the risk of getting caught and the punishment when caught made it worth it.

If the authorities that are supposed to enforce GDPR (and other data protection laws around the world) were doing their job, app makers would be a lot more careful with what they embed and what data they send where. Because these authorities don't seem to have been doing anything useful, it's now so normalized that you could probably send a $20M fine to every major app and be right about it.