Why do so many websites use Cookiebot when it is clearly not GDPR-compatible?

As a reminder, GDPR requires opt-in for any non-essential data collection. With Cookiebot I can't even opt-out of non-essential (e.g. marketing) tracking