Most users aren't tech savvy enough to block tracking technologies and don't have the legal knowledge to actually understand byzantine privacy policies written in deliberately confusing legalese. It's not obvious that the presence of a "like" button, an ad unit or a hidden pixel means that you're being tracked by a third party. None of us have the time to actually read and understand the privacy policies of every single website we visit. The old "by visiting your website, you agree to our terms and conditions" doesn't actually give users any choice in the matter - you're being tracked before you've actually had the chance to read the policy. Opt-ins without opt-outs create a ratchet effect of ever-diminishing privacy, especially when those opt-ins include overly-broad third-party permissions.
GDPR doesn't stop you from creating a service that's a massive invasion of privacy, but you've got to ask permission first in plain language and allow people to change their minds later. If it turns out that users aren't willing to give that permission and revoke permissions that they have previously granted, it vindicates one of the basic arguments for GDPR - users wanted privacy, but they weren't being offered the opportunity to make a free and informed decision.