That's a similar scale as GDPR violations. And EU companies I worked with were always very serious about GDPR regulations, even if their internal training confirms fines were always really small compared to maximums.

US doesn't care about warnings and small fines, though. If penalties are not enforced, it's like they don't exist.