I had too the problem of the GA4 tag firing without consent.
The issue was that I had wrongly set the Default Consent State of Cookiebot CMP to Granted instead of Denied and once I set it correctly, the problem was solved.

In Google Tag Manager:

1. access the Cookiebot CMP Tag
2. modify the Tag Configuration
3. check that the Default Consent State is properly set
   
   I hope this can be of any help.

I had too the problem of the GA4 tag firing without consent.

The issue was that I had wrongly set the Default Consent State of Cookiebot CMP to Granted instead of Denied and once I set it correctly, the problem was solved.

In Google Tag Manager:

1. access the Cookiebot CMP Tag
2. modify the Tag Configuration
3. check that the Default Consent State is properly set