We haven't seen the legal bloodshed yet. But it's coming. I'm sure of it.
The intent of #WP29, I believe, was give controllers some time to get their bearings, maybe hand out some warnings so they don't get complacent. But I'll wager by the end of this year, the legal suits will start being dealt with hard intent, beginning with those who were warned and who garnered data subject complaints.