Not sure GP's meaning, but just guessing here, maybe it trains people to hit "I agree" to everything without understanding, so when they get an actually security warning they just click right past it.
(b) many people make the disagree button small, hard to see, or require clicking through multiple screens to get to
GDPR really should have dictated "agree" and "disagree" be of equal visual weight and button styling and dictated disagreeing to be a 1-click action.
I'm pretty sure that everyone doing our (b) is not compliant at all. The problem is that GDPR isn't being enforced very well.
It does mandate something to that effect: the user should not have to spend more effort to disagree than to agree.