The EU also does this with corporate fines, GDPR violations are up to the higher of 20 million euros and 4% of global turnover.
If we want to stop bad behaviour, there can be NO PROFIT from illegal actions.
So if a company makes billions of dollars, through illegal actions, all of those billions of dollars need to be the fine, and the board and senior executives should also face personal fines, so they aren't also profiting.
Making the fine cover all revenue from the crime makes more sense. A bank robber doesn't get to claim that some of what they took should go to pay for their getaway car.
I had trainings upon trainings about this, particularly because in my line of work I deal with medical data, which is categorised as sensitive.
Not enough not, you still get almost all market participants trying to skirt the law instead of actually respecting it.