I think GDPR assumed companies would like to do right by their visitors. I guess the only way to do that is to increase the severity of the consequences for violating user trust. GDPR itself offers a guideline that many seem to misunderstand... you don't need a popup for every kind of cookie.

I'm not against enforcing minimal tracking as default, and opting into cookies should be similar to going through a purchase flow... because it is one, just using "data" as a currency. So yes, convince me to click the "Buy cookies" button.