Legitimate interest checkboxes are technically not asking for consent, they are considered informational. OneTrust popups are especially inflammatory in this regard.
Legitimate interest can absolutely be opted-out of:
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
That doesn't say you can opt out. It says sometimes legitimate interests aren't enough. For example, as a hypothetical service provider I have a legitimate interest in tracking your GPS location everywhere you go, because it helps me predict what kind of service my customers like based on where they live and work. However, your right to not be tracked is more important, so I can't use my legitimate interest to justify the tracking in this case.
