So GDPR helps you in maintaining control over your data as you see fit.
Consent could be withdrawn before or after GDPR. My guess is that the school have realised they're at risk of having to reprint all their promotional materials if consent is withdrawn.
So they need a contract, a model release. They needed that before GDPR. If you don't like the terms, don't sign it.