They're not necessarily legal
It may well be that many of the smaller sites don't actually have a legal right to use these photos. GDPR is a new law that's not yet widely enforced, especially in minor cases. Many active organizations did implement GDPR policies and obtained (for example) legal consent from their members regarding allowable use, however, many (especially smaller and less active organizations) did not.
While a news site or a search engine would have some basis for using these photos, a commercial organization (i.e. like the UK club/pub in one of your links) using photos in what's essentially advertising would not have anything other than consent as the legal basis of using these photos. Maybe they have asked the consent of all the people seen in their galleries - there's no way for others to know that. I've seen all kinds of organizations (e.g. a school publishing photos that include their students) now asking explicit consent according to GDPR to enable publishing these photos, naturally including the option to decline.
The enforcement is very loose
The main factor in this is the GDPR (non-)enforcement process by the appropriate local agencies. In essence, unless you have a really large scale or public visibility (e.g. Facebook), enforcement is based on addressing complaints by those whose rights were violated, and even then usually only if they've attempted to resolve this issue with the data controller and they didn't react accordingly. So for some academic organization or small club it's not causing really any problems unless (until!) one of the people in these pictures complains. Often, the result of such a complaint is the owner simply taking down all the photos from the site.
There's a simple way to determine this experimentally - if you're in EU, you may simply ask any organization who distributes photos with your face about their handling of your PII, and they're required to answer you under what lawful basis, in their opinion, they're doing this. It may well be that they'll answer "oooh, we actually can't, we'll take them down if you don't like them". It may also well be that if they haven't thought about GDPR (yet) that they'll be unable or unwilling to answer reasonably, in which case nothing will happen unless/until you involve the local regulatory agency.