Do you have any evidence that this process actually works, or are you just parotting what we have been told over the last 5 years?

In my experience, there is actually quite a barrier to this, meaning most situations where you see a GDPR violation are not easy to escalate.