Part of it is lack of enforcement. The GDPR requires that rejecting tracking be as easy as accepting it. If there is an "Accept all" button, then there must also be a "Reject all" button. Furthermore, there can be no penalties for rejecting the tracking. So clicking the "Reject all" button may not bar the user from the site.