GDPR states, that even if you give consent now you can withdraw this consent anytime. So even if OP consents now and in one year decides he/she doesn't want the daughter's videos being used anymore he/she can do this and the school needs to honor that (or else: big fines).

So GDPR helps you in maintaining control over your data as you see fit.

This law has nothing to do with signing away the rights of your image to be used for publicity, though. GDPR does not come into play at all in the scenario with your friend’s daughter; the school is likely abusing laws in their request and should be investigated, but those laws aren’t related to GDPR and the existence of GDPR does not somehow cause the daughter’s position to be weaker here.

I'm skeptical this is genuinely because of GDPR.

Consent could be withdrawn before or after GDPR. My guess is that the school have realised they're at risk of having to reprint all their promotional materials if consent is withdrawn.

So they need a contract, a model release. They needed that before GDPR. If you don't like the terms, don't sign it.

Under the GPDR, you can't "sign away" your rights. You always have the right to cancel any "contract"/"agreement" like that.

.. but not having the opportunity to say no to the form and the data being taken anyway is worse?

English may not be my mother tongue but I can logically follow an argument. Your friend' daughter was not obligated to sign such contract and GDPR reinforce previous laws protecting her image ;)

How is this relevant to GDPR?