In some countries your competitors or some other third parties can just directly send you a cease-and-desist letter if they believe you're violating some law.

Even if that letter turns out to be unfounded because it turns out that implementing a shopping cart using cookies without an explicit consent is a legitimate use case, they're quite a bit more of a hassle to handle than your supposed friendly ICO just "get[ting] in touch with the site owner to help them come into compliance".

So one more reason to err on the side of over-caution and just put up a popup for any kind of cookie...