Problem is, those players will still incur the compliance costs. The GDPR rules are not simply penalties for bad behavior. They mandate proscriptive actions companies must take, policies they need to design, services they must perform on demand, etc. whether the company is engaging in bad behavior or not.