The default is doing most of the work
An opt-out default enrolls a principal in some ongoing behavior automatically, requiring an explicit action to leave rather than to join. In principle, both directions offer the same reversible choice — a person can end up in either state with the same amount of effort. In practice, most people don't act on a choice they're not actively prompted to make, which means the default a system picks ends up determining the outcome for a large share of people almost regardless of how easy the alternative technically is to select.
This is why the choice between opt-in and opt-out deserves real deliberation rather than being treated as a coin flip with no consequence — the two produce measurably different real-world populations enrolled in whatever the behavior actually is, even when both are, on paper, equally reversible.
The same question applies beyond consent specifically
The underlying question — which state does inertia favor — generalizes past consent flows to authorization defaults broadly: a newly shipped feature that's on for everyone until someone notices and opts out behaves very differently in aggregate than one that's off until someone deliberately opts in, and that difference compounds across every feature a system ships this way over time, not just any single one in isolation.