It's only 'mandatory' (see comment below) if they (whether the primary operator or the subcontractor) is doing things that aren't strictly for functionality.

The problem is that while the EU hopes that disclosures are designed to introduce friction to make the site more privacy-friendly... let's say that money is still a strong motivator for a lot of websites. I even spotted cookie prompts that were essentially that "close door" button on lifts.

No, banner isn't mandatory. Information is mandatory. I don't remember exact page now but it was some govt page here in Poland that had info about cookies in page footer, and it was also ok