Of course the government is going to enforce only a fraction of the offenses it creates. This is nearly always the case, and is mostly irrelevant to a law's actual effectiveness. That is derived from a combination of targeting the highest-profile offenders and the law acting as a press release as to the government's enforcement priorities.

Like, imagine you're running a team developing an end-to-end encrypted application in Britain, and you're seeking funding. The potential investors are going to ask what your plan is to not get owned by this bill, you won't have a good answer outside of "hope they don't notice us", and they won't invest. This happens merely because the British government publicized the Online Safety Bill, and exactly zero enforcement effort was required to stifle the funding, development, and subsequent use of this hypothetical application.

Anyhow, the short of my point is that government laws have a ton of power to shape behavior outside of prosecuting people, and sensible risk-management shapes the behavior of non-government bureaucrats and decisionmakers.