A lot of people have forgotten that cookies aren't just for session id and can store anything. The browser also sends them all in the initial GET request. So yes you're right, it could have been done server-side for the 2nd visit.

Also, because of cookie banners, they got a bad reputation even though most countries allow you to store non personal data. Even just data that is necessary for the functionality of the website doesn't need permission.

Setting a cookie is a good idea—I honestly just didn't think of it. I created a todo for myself to explore that whenever I can get around to it.