It’s not the legal risk, it’s the desire to track users. How often have you seen a cookie banner that says “we only set cookies when it’s essential to the site’s functionality so there’s nothing for you to opt out of”?

It's almost every site big and small, so there must be plenty of cases where they don't even want to track users.

And yet I don’t think I’ve ever seen it.