Not only is it legal, it’s expected by the law. It specifically mentions that rejecting consent must be at least as easy as giving it. Websites just choose to make it hard to reject, going against the law.

You may have noticed many websites have begun to be better behaved in that regard, for which you can thank organisations like noyb (https://en.wikipedia.org/wiki/NOYB).