They just need to ban these companies from operating in their countries. They are fundamentally burdens on society run by bad people.
Your best case scenario with fines is getting them into the narrow definition of compliance just until a new "innovation" gives them a different way to conduct the same abuse while evading the letter of previous judgments.
This works best when you've got the ability to opt out of using those companies. If there's no meaningful replacement for a company's services or the entire internet is infested by it to the point where it's unavoidable a ban isn't going to do much good.
What would a ban on Google look like if people still want to email others using gmail accounts, watch youtube, or use android devices? What would a ban on cloudflare look like when all of your nation's traffic passes through them? One way or another these companies will end up with vast amounts of your people's data and the EU should be able to hold them accountable somehow for holding, selling, or using it in ways that violate their laws. Fines are pretty much the only lever they have to pull.