You are correct that joint controller situations are messy and potentially difficult to navigate. But the “joint controller” concept reflects the reality of the legal situation that more than one person/entity can meet the definition of a “controller” for a particular processing activity.
It is possible to avoid joint controller situations, for example when processing activities are structured suitably, or when one party engages the others as data processors. Of course, it would be contrary to Facebook's interests to act as a data processor because FB wants to use the personal data for their own purposes, not solely for the other controller's purposes.
Some detailed notes:
The Fashion ID case does not involve the setting of cookies, it applies more generally to any personal data a browser might send while making a request.
Both of these cases are not about Facebook's responsibilities, but about the responsibilities of data controllers that use Facebook's services. You can't just embed/use third party services and argue that you're not responsible for compliance.
GDPR does not require explicit records of consent to be stored. Doing so might even violate the data minimisation principle. The GDPR has the weaker requirement that “the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data” (Art 7(1)). This could perhaps be demonstrated indirectly, e.g. that it is not possible to trigger the processing activity without giving consent.
Instead, embedding pages typically collect consent for the loading of third party content, e.g. “click to show content from twitter.com” or a greyed-out Facebook icon with a toggle next to it. This page (about the Fashion ID ruling) has a wonderful example with an embedded YouTube video:
The video is currently deactivated to prevent unwanted data transfers to Youtube.
To activate, please click the link!
This will transmit data, but we can't provide information on their type, scope, and purpose.
Link: show video
There is no such thing as implicit consent under the GDPR. Consent must be indicated unambiguously. Art 4(11) defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data”.
It is quite likely that, were Facebook to set cookies via embedded Like buttons or to use Like buttons to create profiles of users that are not Facebook members, that Facebook would be acting illegally. The lack of suitable consent would be a concern. But that matter was not being litigated in the cited cases.