>Is the law as written somehow vulnerable to some legal hack where all my revenue goes through Company A but all my data goes through Company B, so that Company

>Is the law as written somehow vulnerable to some legal hack where all my revenue goes through Company A but all my data goes through Company B, so that Company B has a small global revenue despite being extremely profitable to the controllers of the companies? No. Who the data controllers are is a matter of fact, not assignment. To quote the Court of Justice of the European Union in the Fashion ID case (C‑40/17) at paragraph 68: "[A] natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller". Furthermore, as per that case, multiple data controllers may exist for some processing activities. So both Company A and Company B may be considered to be Data Controllers and thus both liable.