the GDPR would not allow 23andme to sell genetic data to insurance companies without strict opt-inThat's true. But there's a different issue and the very reason why I would never do such testing.
An insurance company cannot enforce a genetic test on you in order to write a policy. What they can and will do, however, is ask you in the questionaire for such a policy if you did a genetic test and if yes they would oblige you to share the results before writing a policy.
The problem here is you can't lie. If you did a test and you deny it and it's proven later that you lied the insurance will refuse coverage.
So it's in your best interest not to get tested at all.
My understanding is that it's very different in the US. Such data is insanely valuable to insurers and that directly translates to the prices they're willing to pay for it.
Unethical? Sure as hell. Illegal? Probably not without a strong legal framework.