So when I see a tracking cookie dialog on a web site, either 1. the site collects more data than they need to in order to run the site or 2. they don't and the site's management is incompetent. Both are pretty good reasons to avoid that particular web site.
There's no risk, they know what they are doing because the law doesn't just mandate the banner, it mandates you to know which third party service you're sharing the data to.
Check the banner next time, you'll see how many “partners” they do sell your data to.
A lot of websites for smaller businesses will not be run by technical people, they'll be run by business people or otherwise who don't understand cookies beyond "I see cookie banners on every website I visit, therefore to avoid legal trouble I need one too", you can't expect someone like that to understand the difference between tracking cookies and technical cookies.
Ah yes of course. How could I forget about poor Mom & Pop Co. and their 186 business partners that they want to share my personal data with. Surely we can't expect such a small operation to know what they are doing.
That's not the point I'm making, I'm saying whoever in Mom & Pop Co. set up the website may well not understand the difference between the cookie types and even if they are using no tracking cookies and sharing no data, they may well put a cookie notice on their website anyway as they're so common they think they're normal, the law allows for huge fines, and they're doing it out of an abundance of caution.