If he still profits from the behavior, has he really been punished?

It has to be bigger than what the business can accept as "just a cost of doing business" or it isn't actually a deterrent.