There is some truth in that, but a lot depends on the exact circumstances. For example, in some cases, the default position is now that the provider musn't actually provide until the end of the 14 day cancellation window, and if you want to get around that then various explicit acknowledgements are required from the customer about immediate supply and giving up the right to cancel once provision has started. Moreover, if the provider gets any of this stuff wrong, the penalties can be heavily one-sided in favour of the customer. As usual, whether any of this actually matters depends a lot on whether the amount of money or other risks involved are significant enough to take meaningful action. Also, if we're talking about privacy/security/data protection concerns, the consumer protection rules might not be the most relevant part of the law anyway.
(I spent a significant part of this year taking legal advice about these changes, but I'm not a lawyer myself, so you shouldn't trust the above any more than any other random legal commentary you find on the Internet.)