And at the server where it's sent to, it gets disconnected from the IP address and intermixed with other people's browsing history. So, it's not stored in personally identifiable form and therefore not vulnerable there either.
Mozilla has also made an official statement that neither they nor Cliqz store personally identifiable information as part of this, so doing it anyways would be misleading of consumers, i.e. breaking the law.
Not to mention that it would violate German privacy laws (which is where it's currently being tested), if they collected personally identifiable information without clearly notifying the user and at least some checkbox that the user has to tick.
It's easy to spin this, so that it sounds like Mozilla is doing pure evil here, but it's just not the case.
Edit: Ah, this is a part of Firefox. It looks like they're using some crypto/privacy features such that "aggregation is not technically feasible".
Strongly blinding stuff that way isn't new; e.g. the safe browsing stuff uses differential privacy.
FWIW in Firefox nightly (maybe also beta?) if you flip the privacy.firstparty.isolate then the fact that websites can talk to each other is severely reduced; basically third party iframes get their own set of cookies for each domain they're embedded in, so tracking iframes know about each other less. Flipping this pref will log you out of everything though (only the one time), and some sites don't work with it (nothing major so far, and you can file a bug. In many cases it's the site relying on iframes in a weird way).