Exactly - and the regulators thought of this. The obvious/simple/default option MUST be the one that protects the users information the most, or the GDPR is violated.

The law is written understanding that users are lazy/ignorant/non-technical. Anything else would have been useless.