I feel this is a good change as it also emphasizes window/terminal focus is at correct place and user do not unintentionally type the password to another focused place (chat etc.)
I've installed GNU/Linux (mostly by Mint distro and Mate desktop) to both of my non-tech parents home laptops like 10 years in a row now. Non-tech in this case means browsing, banking, printing, email, docs and sheets, video conferencing (mostly MS Teams), etc. I keep these machines updated remotely ~once in a month.
After Windows XP/7 family originated support requests have declined like 95% being only 1-2 per year for past years. I don't give all credit to Linux/Mint/Mate/apps but to the fact installing any unnecessary bloat to an average Linux requires a bit more than just clicking "Install me" button on any web page and then (generously instructed by the browser) run that .exe in admin privileges.
Yes there are Flatpak and friends and I'm already a bit scared they will evolve easy enough to install bloat increasing family originated support requests to Windows days.
Documented instruction set switch which is just implemented poorly. But the real news here seems to be that the ALTINST is set to 1 by default in some C3 generations.
are you referring on to a case where you have not met the regulations (from the perspective of the information and options you give to your end-users) and authoritative entity comes to you with warning which you are not going to notice
-OR-
are you referring on to a case where personal user data is stored and used without end-user explicit consent and/or knowledge and/or that data "leakage" has caused/will probably cause in the future real damage to this user
..but still here in European Union the preference has been (at least pre-GDPR era) to first give a written warning to service provider about not being inline with the regulations. This has also included a period during which the provider can fix it's behavior. If regulations are not met after given period only then (usually progressively and aligned with the extent of the business and real damages caused) monetary penalties will arrive. This is EU not US.
When looking here from Finland GDPR is not that big change as we have had quite strict national regulations in place since 1999. The biggest change here is that user should really be able to get all it's data removed permanently from whatever service she/he has previously used (usually referred with terms right-to-be-forgotten). Another big change is that it is not anymore up to only the actual end-user to raise a lawsuit about personal data losses but to give also for an authoritative entity possibility to raise that lawsuit without prior actions of the original end-user.