The documentation talked about how to block this capture but that involved a developer getting involved and the developers didn't even know about the plug-in.
Basically, don't add a third party service to any app or website without doing a secuity review, especially if marketing, product or UX have suggested it!
* www.mydomain.com - install Google Tag Manager, let the marketing people go crazy
* app.mydomain.com - all tracking request has to go through a developer
That works well for SaaS type of products. Not so well for online stores where you want everything integrated.
Even there, that's dangerous. Most marketing people are not trained in legal matters and install all kinds of shit with dubious legality. In addition the tons of trackers on websites make the user experience really slow. Approval by legal and tech should be the standard process, not "marketing has free rein to fuck over the company due to messing up GDPR compliance".
You're reliant on them behaving in the same manner consistently, and behaving ethically when they change their service's behaviour.