However, data collected for that "legitimate interest" may only be used for that specific legitimate interest. They can't turn around and use it to end-run the consent requirement.

Also, the "legitimate interest" of the business is required to be weighed against the interests of the data subject, so it isn't a blank check.