Because your boss has a boss who has a legal adviser who tells him they have to have the appearance of meeting the requirements of the law/regulators. Compliance theatre. They all know it's smoke and mirrors but it ticks a box in someone's board meeting agenda.

Because there's a huge difference between being "blatantly non-compliant" vs "properly compliant".

I suspect most sites will get a warning first. I have a website myself with Google Analytics and I've never added a banner myself, I'll wait for the warning first, and I expect my users to have blockers installed if they're privacy-conscious.

If GDPR starts to be enforced, they’ll go after the low hanging fruit first.

You don’t need to be compliant, just more compliant than the worst.