Yeah! And this is the only legit way to do it if you actually follow GDPR. It has to be just as simple and easy to opt out as it is to opt in. But unfortunately most sites that rely on surveillance don't want to give an easy way to opt out.
I think the real answer is more banal than that: most sites just installed the first Wordpress/Drupal cookie banner plugin they could find, maybe themed it a little, and called it good.
Also, most sites would rather you accept cookies than not do so, that's why they're giving them to you. But I don't think most websites rely on surveillance in any meaningful way, the landscape is just guided by the ones that do.
There may be some like that. But studies have proven that 90%+ people say no to tracking when given a fair chance. So any site that monetizes with personalized advertising banners (or any site that uses tracking such as pixels for marketing purposes) doesn't want to give that fair chance as they would lose out on what they can do now.
