If sites use this because it's easy to set up, then Cloudflare has done something good for the internet. Compared to the alternative, which is where they choose a product that loads up dark patterns to get users to accept cookies.
Google Analytics is problematic[1], consent or no consent, unless you send anonymized analytics events through your own proxy server.
[1]
Austria: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...
France: https://www.cnil.fr/en/google-analytics-and-data-transfers-h...
Denmark: https://www.datatilsynet.dk/english/google-analytics/use-of-...
Finland: https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-antoi-h...
Norway: https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/va...
Not really, since embedding YouTube and Twitter should work even if the consent for tracking is refused (under GDPR consent inherently is opt-in, not opt-out; and consent is valid only if it is freely given, i.e. if you don't refuse service to those who refuse consent), and for that you don't necessarily need a popup, because you're free to assume that noone opts in to anything where a choice is provided - if you just treat everyone as if they clicked 'I refuse any optional consent', you don't need to ask that question.
Should it? I mean, GDPR wise you're sending a subrequest by embedding eg. an iframe - which involves user data that might be used for tracking by yt/tt etc.
Shouldn't it be better - to err on the safe side - to just replace eg. the embedded player with a placeholder (maybe featuring a link to youtube) unless user has given consent to the embedded player?