Even EU institutions use cookie banners. Also, if it was just malicious compliance, there would have been years of time to fix the regulations so that such shenaigans would not fly.

I think the problem is that GDPR focuses on consent more than would be prudent. Regulation is usually introduced when some actions are not appropriate even when there was consent. For example, one is not allowed to sell spoiled food, no matter how clear warnings they gave to the customers.