If Marriot can prove that they anonymised the data wherever possible, deleted all the data that they didn't absolutely need, took all possible steps to prevent

If Marriot can prove that they anonymised the data wherever possible, deleted all the data that they didn't absolutely need, took all possible steps to prevent the attack, and took all the required steps once they detected the breach, then they won't be facing huge fines. The fines aren't for "having a breach", the fines are for mismanagement of their customer's data and negligence around the breach. It's not the inability to protect yourself that's the offence, it's not doing the right thing in the event of a breach that's the offence.