Romania has already deployed GDPR as a weapon against its press . I also have a short list of anecdotes of economic activity (start-ups and other new market entrants) that would have happened in the EU but, in large part due to compliance costs–including GDPR–wound up happening outside the EU.
Giving people in power broad discretion with the law and then counting on them being nice is a delicate strategy. It counts on every administration being benevolent.
> Romania could just have used another law or just made a new one to harass the press
There is a big difference between using the authority of the EU, through an EU regulation, and passing a domestic law to go after people you don't like.
More broadly, this argument can be made against any over-reaching law. Just because some hypothetical law could be bad doesn't make an ambiguous law granting widespread power to select bureaucrats okay.