Ha, I was just working on a blog post on this:
Your observations are accurate. The mkto_opt_out cookie does not obey the Munchkin domainLevel setting (whether manually or automatically set).
The "good" news is that the use of the querystring for this was flawed anyway. (The use of a no-track cookie itself is sound, but I'm talking about how it's set.)
Most people are not going to understand how to add to the querystring before Munchkin initialiizes for the very first time. Even if they know (which is rare on the web side, let alone the marketing side) how to use replaceState, they're not going to change the querystring on the first hit, instead waiting for cookie opt-in to complete and then refreshing the page with the &marketo_opt_out=true appended. As a result, they're still going to track the first hit (with or without the lead's consent) and they're also going to create duplicate pageviews for any other analytics package, and duplicate traffic to their server. Kind of a lose-lose-lose.
So the way to use this functionality is to set the mkto_opt_opt cookie at the topmost private domain yourself, and do it before any calls to Munchkin.init(). Of course you can use findPrivateSuffix to automatically figure out the appropriate domain.
Thank you Sanford Whiteman for confirming that I'm not nuts. 
I was checking out your blog but I don't see that your article has been posted - at least it's not visible to me. As usual, I gain so much from reading your blog posts. I'm looking forward to reading this one!
.png)