Is this actually legally binding? What would be the difference w.r.t. informed consent, between DCOs and the "I have read and accept the terms and conditions" checkboxes from most websites?

It also gives me similar vibes to the Do-Not-Track HTTP header since both can be enabled by default.

DCO is something like "Signed-of-by: me myself <me@example.com>" you have to actively add to your contributions, which is usually a conscious and willful act that is far more complex than blindly ticking a box (or even leaving a pre-ticked box ticked). Since that bar is higher, I think the legal weight should be higher.

CLA-Assistant is also similarly simple to fill out, so that can't be the difference there...

The linux kernel relies upon one, so I can't imagine it wouldn't be.

We've looked into the DCO before. It turns out CLAs are more common and easier to deal with, thanks to a tool like cla-assistant.io. We ended up opting for it for the sake of simplicity.

It's not a good argument, smoking was once very common and still is common in many parts of the world.

https://drewdevault.com/2018/10/05/Dont-sign-a-CLA.html

You can use DCO legal text with CLA Assistant though!