Looking at the fields in the block header, the nonce field is a 32 bit integer. This means that the nonce is an integer in the range from 0 to 4,294,967,295. As you point out, a miner with just an off-the-shelf GPU can easily calculate this number of hashes in less than a second.
In the early days of bitcoin, when the difficulty requirement was much lower than it is now, miners would scoop up a bunch of transactions, take the Merkle Root, use the current time as the timestamp, create the header, then iterate through the range of nonces - and they stood a decent chance of finding a nonce that (when combined with the rest of the info in the headers) produced a SHA256 hash that satisfied the difficulty requirement.
But nowadays, with the difficulty requirement much higher, miners stand a very small chance of finding a nonce that (when combined with the rest of the info in the headers) produces a SHA256 hash that satisfies the difficulty requirement after iterating through the range of nonce values. Therefore, they have to try again, by changing something else in the headers (e.g. the timestamp, or the transactions in the block), then iterate through the range of nonce values again in hopes of finding one that satisfies the difficulty requirement. This process repeats many times, until finally a miner finds the winning combination of header information and nonce that produces a hash that satisfies the difficulty requirement - which should happen approximately every 10 minutes by design.