The point is that you'd still get cookie banners even with option 1, because a site can always ask you if you're willing to override your default preference.
What you are describing is still option 3 (cookie banners). The only real option 1 would be for sites to give up on tracking users.
So yeah, you can never compel a site designer to stop doing a thing without compelling them to stop do that thing. The only middle ground is a middle ground.
It could. And the GDPR already bans dark UX patterns in consent popups (i.e. making it artificially difficult to refuse consent). But the law can’t realistically tell sites exactly how to design their UX.
