The cookie banner is only required to store data on the users device. the tracking without is still possible and potentially allowed via legitimate interest.
If they want more they already ask for more outside the cookie banners when they require or want to have your consent (e.g. consent to load content from sources which will transfer your data outside their control e.g. youtube-embedings)
The limitations of whats allowed is already established in the GDPR, so anything you cannot find legitimate reasons for is already not allowed e.g. simply selling your data to other companies (as long as they include PII)
And as coupling is not allowed either its not allowed to couple consent with a cookie banner (which should only be used to ask for permission to store data for purposes which arent required for the usage).

What we do need is to have a technical implementation of the browser to tell the website via standardized methods what is allowed or not.