Sure, but if the cost of paying the fines for that is less than the expected loss of revenue from demonstrating, directly, that you can't keep user data safe (to a global audience, not just Europe), it's rational for Facebook to take the fines (of course, arguing via their lawyers as long as possible that they shouldn't be required to pay them - lawyer bills are harder to spin as an admission of guilt).

I don't like it, but it makes some level of sense from their perspective. We tend, globally, to prefer "gentle swat on the back of the hand" level penalties for companies that have behaved terribly.