The EU is not the USA - the majority of small businesses will never need a lawyer at all!
To her, what does being "mindful of their user's privacy" even mean?
She probably has analytics installed. Maybe she collects some emails.
There is zero chance she is going to be abusing her user's privacy. All GDPR has done for her is cause stress -- and caused her to spend more money on basically useless "GDPR plugins" for Wordpress.
There are countless people like her, who are spending money effectively on nothing. Because of GDPR. It's horrible. In my opinion.
If her admin password is 'password123' and her database and analytics get dumped by someone, it doesn't matter if she wouldn't abuse users privacy, because others will.
I concede that chances are low, but I contend they are non-zero.
You can't legislate that online services be provided any more than you can legislate that Apple provide iPhones for everyone. The government can offer subsidies or refunds or some other consideration, but there must be something in return.