The Measurement Protocol is something completely different. MP allows for server-side sending of tracking data, as opposed to client-side, which is what the gtag.js file provides.
Server-side sending of tracking data remains the most GDPR/privacy friendly approach, when done properly, because it allows you to filter any information that can be used for fingerprinting, before sending it to Google Analytics 4.
First party cookie does not equal GDPR-compliance at all, it just doesn’t allow for cross-domain tracking. Which is why I said “more compliant”. It doesn’t automatically make your site GDPR compliant.
An example, that’s why CAOS Pro takes a hybrid approach and leverages the features of the new GA4 JS library (it being a first party cookie, real time tracking, consent mode framework, etc.) but still sends the tracking data server-side.
Hope this answers your questions!