You are not wrong.

But beware the predatory lawyers who will come after you for ostensible violations of California’s Invasion of Privacy Act, California Penal Code section 630, et seq. (“CIPA”).

One company I work with received multiple arbitration demands (claimed "privacy" damages in excess of $25000 each, helpfully offered to settle for $5000 each!). And this company didn't even set any cookies or run any 3P tracking on their site!

Their (famous-you-know-them, expensive, California-based) lawyers said "yes, we are seeing this more and more. We can fight and win for $200K, or you can pay the $50K of claims outstanding and add a banner to your site".

Their CEO chose the less-expensive option. :-/

Very few people understand the law and just opt to defensively throw a cookie banner up on the site. Usually a 3rd party service.

At this point I’ve even had clients ask for it, thinking it makes their site more professional and credible, since everyone else does it.

> It's only when you engage in user-hostile practices, such as tracking, that you need to ask for consent.

Which is what the majority of sites want to do which is why there is a good reason for a cookie banner, by definition.

I believe that you need to inform users about the use of strictly necessary cookies as well. You just don't have to ask for consent before adding them.

https://gdpr.eu/cookies/:

> While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user.

There's nothing about a cookie banner in GDPR, it's just the most convenient (and, often, laziest) solution to the question of how to confidently say you've told users something.