I think it's actually a very intelligent threshold structure. It scales with the population of the state/country in which a company committed a crime.

For example, let's say Equifax illegally sold the entire contents of the W-2 Forms (or similarly sensitive data) of 6500 to... oh, idk, Belarussian intelligence agencies (random example). This is no less egregious of a crime than selling 420,000 W-2 Forms of Californians to the same people.

It matters quite a lot to the people affected by criminal negligence; and a companies' (and its executives') responsibility to data security is not in any way diminished by serving only 100,000 people rather than 2 million people.