They can run 100’s of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.

The impact of this is probably greatly reduced by anti-JS measures like NoScript. Some sites probably still bundle fingerprinting code into their own scripts, but the really big players contract that out to companies whose entire purpose is data-harvesting, and that’s easily defeated by denying scripts from outside domains