The paywall is the author's choice and anyone is free to reject creating a Medium account, no damage done on either side. OP's second objection on the other hand looks less "rejectable" than a paywall because the damage is done before you have the chance to reject it:
> By using Medium, you agree to our Privacy Policy, including cookie policy.
Medium's implicit assumption that by clicking on their link the user accepted the policies is illegal under GDPR. It doesn't give the chance to reject before being tracked.