That may go some way to handle the perverse incentives as well.

If I do something very illegal to double my revenue, I've also doubled my fines.

I spent some time in traffic court and it was clear how punitive fines are for lower income.

Fines for GDPR violations work that way too. A severe violation can be penalized with "a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher." https://gdpr.eu/fines/

“up to” is the problem at hands here.