There’s no EU rule that dictates how sites have to get consent. They just all chose malicious compliance. If a site wanted to, they could make it a click or two.
Even worse: Popups that make it harder to deny than to consent actually violate the law, but no one has taken the effort to drag this through the courts yet.