But sure, let's explain the downsides:
1. this isn't an all encompasing law. It's only for sites that host adult content. You know what people will do... remove adult content.
2. As we see this year, rules are useless without enforcement. I'm sure X or Reddit or whatever large companies will strike deals and be exempt. This will only harm the little sites who get harassed by vested interests.
3. There's been campaigns to try and assossiate LGBT to pornography for a while now. This will delve beyond porn and be used to enforce yet more bigotry. This "think of the children" rationale is always their backdoor to stripping away freedoms, and I sure don't trust it this time.
4. On a moral level, I care more about retaining my pseudo anonymity than about worrying over bots. I'm not giving my ID.ME in order to interact on a games forum, for instance. The better way to address this (if these people actually cared about it) is to force companies to disclose with commenters are being operated via bots. Many websites have API's so that would eliminate many of them, even if it's not perfect.
5. This execution sounds awful. On a general principle, I do not want people sued over state laws that they do not reside in. Why should California need to comply with Floridian laws? This is why porn sites impacted simply block those state IP's. The Internet is more and more connected, so you can imagine the chaos is this is generalized more, instead of actually taking hold and making federal laws. This is half hearted.
It won't harm anything. Even now as these things spread nationwide something like Stripe or whatever will pop up and fill the need as a service. It used to be essentially universally required to prove your age using a credit card. There was/is a company that specializes in that. I can't remember its name but it was ubiquitous for porn access for quite a long time. Those over 18 confirmation banners used to be much stronger than the merely souped up cookie notices they have become today. Age verification as a service is trivial (particularly with the rise of phones) and someone will build a system that does a much better job preserving anonymity than credit cards ever did. At this point all you need is something like a passkey or FIDO token and a way for something to vouch age during account creation.
I agree that federal law is preferred.