The problem is that GDPR doesn't go far enough. It should completely prohibit third party tracking without the possibility to agree to it. Third party cookies/tracking simply should not exist.
The "little guy" or the browser?
The problem is a chronic lack of enforcement that allowed websites (and entire companies such as TrustArc/etc) to implement these malicious pseudo-compliant solutions and get away with it, at the expense of everyone's privacy and sanity.