Under the GDPR provisions, strictly necessary cookies are exempt from the consent screen. But the way the exemptions read prompts all the lawyers to "well, maybe it's sort of necessary for you to have a session_id, but its so, so much safer to have the damn consent screen, so please...".
I worked in technical roles at large companies that had completely honest-to-god private, strictly necessary cookies - where compliance people forced the cookie consent screens, there was no space for a discusion. At my latest company, despite being a CTO, I could not convince our legal team that going without the consent screen as we are really only using "strictly necessary" cookies was fine. Its "mate, you may even be right, but really, nobody is skipping the consent screen, and we won't risk a compliance issue on your say-so.".
Sure, lots of companies - maybe even most - do shit things, and of course the real tagging of people and fingerprinting happens in sophisticated ways that actually defy GDPR, require no cookies whatsoever and so on - and thats another problem. Those moronic consent screens server exactly no real benefit for a while now.