The CMP vendors claimed defense is that they make their widgets configurable so sites can judge for themselves what they think they need to legally ask users fo

The CMP vendors claimed defense is that they make their widgets configurable so sites can judge for themselves what they think they need to legally ask users for and give a default maximally compliant interface, but conveniently with lots of knobs to twiddle to maximise "consent" rates by making alternatives harder. That said, even that preview page gives the option to see the "Legitimate Interests" interface by selecting "IAB TCF 2.0" under the regulations section, rather than just "GDPR".