i know there's a bunch of ways to track people without cookies (supercookies, browser fingerprinting, etc.), but is there any evidence that they're being deployed by google or any of the big western advertising companies?

I can say for certain that I worked for a company that wasn't Google and employed plenty of ways to track people that didn't involve cookies.

We used it mostly to try and track malicious users (banned users, etc.) but it's still tracking nonetheless. It was reasonably effective.

I'm sure a company of Google's size and sophistication has many more advanced methods than we did.

Nobody is questioning their ability. It’s their willingness that’s relevant, and considering they are liable for a far more damaging PR nightmare than almost any other company, it’s not out of the question that they might not actually use every trick in their arsenal.