It takes effort to set up server access log rotation. It takes effort for a non-technical person to make sure their wordpress installation isn't storing cookies or logs.

The GDPR doesn't require any of that. All you need to do is show a legitimate need to store data if challenged, and access logs have a legitimate purpose (diagnostic and abuse monitoring).

Larger businesses (250 employees or more) may need a privacy policy though.

The consensus I've seen has been that you can't keep around server logs, especially not forever, just for abuse monitoring. GDPR considers IPs PII.

A "consensus" reached by a bunch of programmers who haven't even read the law has no merit in this discussion. What's clear is that GDPR prohibits using IP addresses to target content at particular individuals. But we aren't talking about that, we're talking about generic access logs.

For example the law itself says: The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned.

The UK's IPO for one example definitely doesn't agree with your assessment of the GDPR and it is their job to help companies adhere to it.