Many of the things listed above (legal requirements, etc) don't actually require consent, so they have different criteria - in essence, Paypal just needs to clearly inform the user what they're doing. Consent is just one of six criteria that may allow you to use private data; the actually necessary (as opposed to merely desirable/profitable) use cases of the data fall under one of the other criteria and don't require obtaining consent.

Consent is mostly relevant to all the marketing and customer analysis activities, which aren't essential to the service, so can be refused, and would be severely curtailed as users stop consenting to these uses of their data.