> Someone did the banner first and everyone thinks that’s what you need to do to comply and everyone copied.
I don't think so. Most sites have teams big enough to know what they are doing, and they know this is the only way to "comply" while still being able to continue business as usual.
> The banner is malicious compliance.
That must be why https://gdpr.eu has a cookie banner /s
The only way to explain it is mass hysteria. Someone did the banner first and everyone thinks that’s what you need to do to comply and everyone copied.