This is only true in Europe - it is not required by the US privacy laws and the default most companies deal with will be set to implicit allow
Not because we're required, but because that's how the off the shelf cookie banner thing we use works, and better safe than sorry should a European access our US marketing site, i suppose.
I always figured most of the popups would reject cookies if hidden, if for no other reason that everyone is too lazy to modify the default behavior (and the default behavior is designed for EU regulations)