The fines are only proportional for big corporations. Organizations without revenue can still be fined:

Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the basic principles for processing, […] pursuant to Articles […] 7 […];

https://gdpr-info.eu/art-83-gdpr/

In this case, the processing of data hinges upon the data subject’s consent, which is detailed in article 7.

Also, this is not an issue for the developers, but for the admins.

Imagine a car manufacturer building cars without brakes and then saying ‘This isn’t a problem for the engineers, but for the retailers’. Of course the developers can’t be sued for this. But that’s not the point! The point is that this bug or missing feature or whatever you want to call it jeopardizes the admins upon which this whole ecosystem hinges. I can’t believe that that’s in the devs’ best interests.