You don't need a cookie banner if you aren't doing anything shady. Using cookies (or other such mechanisms) does not require information or consent popups when they're necessary to make the product/service work for technical reason - the canonical example being session cookies.
The corollary here being, you only need consent popups if you're doing something shady but not strictly illegal. They're not meant to be annoying - they're there because it's illegal to do shady shit without the user agreeing to it, and "agreeing" in the EU means "informed consent". So you have to inform, and then get consent.
It's all pretty reasonable. But of course, people doing shady shit really don't want the users to understand it and risk them not consenting - and they especially hate having to ask in the first place. The industry settled on a "malicious compliance" approach to GDPR - show popups that, as much as they can get away with it, maximize the chance of people consenting to make the popup go away, make the "informed" part as opaque as possible, and generally make this thing super annoying - and then tell people it's all EU's fault, hoping enough Europeans will buy it and the public pressure will make EU undo GDPR.