Funding is a legitimate interest, it's at the very foundation of legitimate interests: companies need to make money to exist. "We need this to make money" is basically all they have to say - it's why Google/FB Remarketing, Cross-Network ID-Sync so all the networks have a unique ID of you when they talk to each other etc is still a thing.
The difference is that they now have to inform you that they are doing it, who is involved and who to direct requests for information / deletion to.
Yes, and I've also talked about this on multiple occasions with a lawyer friend who works in privacy law. A typical claim to legitimate interests would be for optimizing the website and ads on the website for example. It's so commonly used exactly because it's a very simple one-size-fits-all approach.
I have not heard statements going against this from any lawyers.
> "It's so commonly used exactly because it's a very simple one-size-fits-all approach".
ICO says this [1] about choosing a lawful basis: "You must not adopt a one-size-fits-all approach. No one basis should be seen as always better, safer or more important than the others, and there is no hierarchy in the order of the list in the GDPR."
The difference is that they now have to inform you that they are doing it, who is involved and who to direct requests for information / deletion to.