We don't disagree entirely.
But having worked in the public sector i can tell you that whilst fining organisations like schools that are already on their knees financially might sound good in theory, the reality is much different.
The alternative that you allude to is holding DPOs personally liable for breaches and non-compliance. Again nice in theory but in practice it means that in most cases you're holding one person responsible for the actions of someone else.
My org had a high impact breach a couple of months ago. Caused by a part time administrator in an understaffed, overworked team making a very simple and careless mistake.
They'd had their training, they'd been told to double check everything as it "went out the door". But they're human and they fucked up.
Fining us would accomplish nothing. It wouldn't teach the DPO a lesson - they've done everything the law requires. The only outcome that would have any sort of deterrent effect would be to fire the hapless admin person. That deterrent effect would last all of 5 minutes until someone hapless individual somewhere else made a mistake.
This is where GDPR collides with employment law and the real world.