That is, if you want to track your users - that's fine, use as many cookies as you like and don't ask anyone's permission. But it's your job to do the tracking, you can't outsource it to Google.
Tracking within your own website for analytical purposes doesn't fall under the functional interpretation of "strictly necessary"; your site continues to function just fine if the Google Analytics beacon isn't fired, or can't distinguish between a first-time visitor and a repeat visitor or follow a particular user through the site.
I have heard people argue that analytics are operationally strictly necessary; that we need some insight into the behaviour of site visitors in order to operate an online business effectively. There may be something in that interpretation, but I'm a lowly web architect, not a lawyer. As such, I would be wary of accepting this more lenient interpretation without significant input from someone more schooled in the laws of our land (or any land, for that matter) than I.
I'm afraid you are indeed entirely wrong. The rules are not specific to third party cookies. There are some very tight exemptions for cookies or similar technologies where their use is genuinely necessary to provide a requested service, such as for remembering that someone is logged in or the contents of a shopping cart. Anything outside that scope, including using the same cookies for tracking/advertising purposes, is against the rules without explicit user consent.
As someone elsethread pointed out, if this is taken seriously, people will just start browser fingerprinting. That at least means that the information is stored server-side rather than client-side, which the new directive seems particularly concerned about.