You are correct: implementing GDPR correctly is much, much harder and more expensive than people realise. Cookie banners are just the tip of the iceberg.
A few things not allowed under GDPR:
1. Analytics
2. Third-party resources like fonts or JS libraries
3. CDNs
4. DDOS protection services
And I am sure I am missing many more. I am not a lawyer, but I worked with a few.