This entire issue is sidestepped by having graduated fines (which GDPR has). If they keep doing it the amount keeps going up until eventually they go out of business. It really limits the ability to take advantage of the system which hopefully makes it not worthwhile to bother doing.
Up to 4% of turnover. So if they make more than that it is still profitable to keep going.
Not that it is likely that they make that much in profit, but still. There probably shouldn’t be a limit, and there probably should be personal legal consequences such as jail time for repeat offenders.