Except it's not. Which is why people aren't being punished for it and more sites adopt it daily.

Opting out must be just as easy or easier than opting in.

Companies aren't being punished for it often enough (yet), that is true, but it's absolutely illegal.

There may not be many fines but Facebook, Google, TikTok and Microsoft were all fined due to making it hard to refuse cookies.

Amazon was also fined for not properly asking consent. If I remember correctly, one of the company making those annoying cookies banners where you have a list of trackers to uncheck was also fined for this behavior.

It is illegal to not offer a clear and unambiguous opt out.

>If informed consent is used as the lawful basis for processing, consent must have been explicit for data collected and each purpose data is used for (Article 7; defined in Article 4).[11][12] Consent must be a specific, freely given, plainly worded, and unambiguous affirmation given by the data subject; an online form which has consent options structured as an opt-out selected by default is a violation of the GDPR, as the consent is not unambiguously affirmed by the user. In addition, multiple types of processing may not be "bundled" together into a single affirmation prompt, as this is not specific to each use of data, and the individual permissions are not freely given. (Recital 32)

Poland already has a case against the most malevolent one, IAB, in progress.