This is indeed how it should be, and courts have consistently found enforced this.

French law for example specifically says that any implementation must "allow the user to refuse the deposit of cookies as easily as to accept it." [1]

[1] https://www.termsfeed.com/blog/cookie-consent-decline-reject...