Or if the legal department is concerned that someone could claim a cookie is non-functional, so to save the uncertainty and expense they advise always showing the banner. Especially since everyone else does.

It seems like there should be a parallel to “tragedy of the commons” that talks about how a good idea coupled with extreme penalties can lead to a bad outcome by making any risk calculation result in “jesus we just can’t take any chances here”.