If you refer to the flowchart on how enforcement is to be handled (notably including referring to "proportionate"), the FAQs on regulator sites, and even the track record of penalties under DPA you'll find this is not the case.
Why there are some who keep wanting to catastrophise this is beyond me.
The section you are referring to that uses the word “proportionate” gives a brief list of suggestions of the kinds of things that regulators should consider when issuing fines. But it no way limits their legal ability to issue maximum or multimillion dollar fines for minor violations, and doesn’t even define “proportionate”. A hardline country like Germany may easily decide that because they so value their privacy, “proportionate” is a maximum fine for a single violation.
Anyway, "proportionate" isn't as ill-defined as you claim. It's a term of art used in many laws and we (and the courts) know pretty well what the legislator meant with it. Heck, they even list some criteria. If those aren't fulfilled a maximum fine isn't possible. Also, "proportionate" implies that a more severe violation must have a higher fine meaning the maximum can hardly ever be reached.
A law isn't code and shouldn't be read as such.
Yes, they could, as is clearly stated within the text of the GDPR. Regardless, most websites outside the EU aren't going to want to put up with the headache, and will block EU traffic. Who wants the risk?
For example, "due regard shall be given to" has a very specific meaning with decades of precedent and does not mean whatever pops into a layman's head when reading the text.