Using cookies to track state on a website, that is only used for that website, is fine. You don't need to ask for consent. That is how a site tracks things like whether you are logged in.
Logging & storing IP addresses in logs for a reasonable period of time for debugging or abuse prevention is fine and doesn't require consent (falls under legitimate interest).
Querying those same logs for marketing, analytics or market research purposes would not be fine as this would require consent.
The difference between first and third party cookies/embeds is only relevant when the third party may be collecting data (e.g. keeping access logs). This covers things like Google Fonts, Google Maps and social media embeds all of which should be opt-in and have fallback options (like an external link to the otherwise embedded post or map).
GDPR overlaps (or rather, mandates a specific implementation of) only a small portion of the ePD. Most of the ePD is still open for implementation and most of the GDPR does not overlap with it.
They are called 1st party cookies and they are required like you said in order for a website to work but 3rd party cookies are intrusive and invasive.
But I get your point, purpose of a cookie is important.
A couple of interesting bits from https://www.privacypolicies.com/blog/eu-cookie-law/
"On the other hand, providing your customers with a customized user experience or tailored product suggestions is not a requirement for an online store, and cookies that enable these features do not fall under the "strictly necessary" category. You'll need to get consent before you use them."
"Depending on your country's interpretation of the law, you may only need to get a user's "implied consent." Rather than forcing every user to click "accept" ... you can instead display a short message informing them that cookies are being used, typically through a header bar or some other non-obstructive method. After a predefined period of time ... the announcement can disappear."
I think what happened is that a lot of sites went for non-compliance or implied consent until the GDPR came in requiring proper consent for most cookies and harsher penalties (?) and everyone went from 0 to 100. But people were complaining about & blocking even the implied consent banners when they first came in. Now everyone thinks the GDPR is about cookies but it's really about tracking.
Those are obstructive too. Just respect my DNT header; if you don't want to serve me the page after seeing what my preference is, don't show me the page, and I won't read it. I know when I'm not wanted. There are plenty more sites on the web.
Also, GDPR isn't about cookies or browsers.