Data protection authorities don’t need to go through the courts. They have the authority to levy fines. They are by and large slow, understaffed, and in some cases allegedly criminally negligent or coerced into inaction. Try to file a GDPR complaint and see where it gets you. I’ve done it a couple of times. Once with the backing and support of NOYB (argueably one of the most prominent privacy organizations), and didn’t get any sense of the system actually working. Yes, there are some prominent fines trying to set example, but as you say with millions of website and thousand upon thousand of violations, this is a drop in the ocean.