Yes, they could.

Or they could pay the ransom, which they deem to be less expensive than dealing with the regulator, and improve their data security to ensure they don't get caught out again.

I fully understand (and support) the reasoning behind GDPR; I just think that in this case there is a path which is easily open to abuse by attackers.