This is founder-raising-funds math (or VC looking for liquidity math). 200k subscribers might not mean paid subs and it certainly doesn't mean 1-year of paid subs. This could be $9M (a single-month of 250 paid subs) or lower.
Their point still stands though. If the output should be reviewed by a lawyer, then the penalty should be all the profits (and maybe also the wages of the CEO) to deter others from doing the same, and ensure that they don't continue in the belief that an occasional 1-2% is perfectly acceptable 'cost of doing business'.
I think we need to start taking this sort of thing beyond money. I'm not sure if it's warranted in this case, but in general I'd like to see more shareholders going to jail for things their companies did.
If my dog bites somebody, that's on me. It should be no different with a company.