Because if enough idiots do it, stupid managers think it's the standard. The EU Commission is unlikely to know anything about their website, it's made by some department that blindly follows a manager's order that just looked at what others did and copied it.

We could all have used the DNT header as a bypass when the GPDR came out, and you can still use cookies for non tracking purposes without any banner.