GDPR has extended what misconduct entails. If your company acts ethically regarding the privacy of your users you'll be fine.

You are assuming that there is no room to game that. There is and the problem is now you have given those who want to cheat the system a better base to do it on now that the customers have actually given their consent.

So in theory yes, in reality I am doubtful.

You can’t punish companies for misconduct if you don’t have laws against that misconduct.

But we do have laws and we can improve those laws without adding more bureaucracy to companies which is what GDRP do.