I agree with you, except for the last paragraph. The portability right makes reference to the explicit GDPR article for consent: if “Article 6.1(a) of the GDPR”, then “Article 20 (portbaility)”. The ePrivacy consent recital (17a or 18) says (in the Lauristin version):

For the purposes of this Regulation, the consent of an end-user, regardless of whether the latter is a natural or legal person, should have the same meaning and be subject to the same conditions as the consent of the data subject under Regulation (EU) 2016/679. The end-users should have the right to withdraw their consent from an additional service without breaching the contract for the basic service.

In other words, ePrivacy consent has the same meaning, is subject to the same conditions, but does it explicitly grant the same rights?

Talking to EDPS, I felt as if I was a little paranoiac, given the general lack of attention to this particular point. Am glad to see there is a second person looking at those “details”.