Basically different devices and browsers render high-level graphical objects, such as fonts, differently. When you visit a site that does canvas tracking, a small javascript snippet will ask your browser to render a few graphical things on an html5 canvas and export that canvas to a png. The hash of that png is a good fingerprint of your hardware, browser and rendering software.

Just to be clear, the only reason to do this is fingerprinting, correct?

which has legitimate use cases in fraud detection and login security (eg recaptcha)

It's a bit of a stretch to cast those as "legitimate use". A security vulnerability is a security vulnerability, regardless of who exploits it.

The Wikipedia page has a pretty good summary https://en.wikipedia.org/wiki/Canvas_fingerprinting

Basically Canvas is a JavaScript API for programmatically drawing graphics and text. Subtle differences in color, font rendering, antialiasing etc will produce different rendering on different hardware depending on OS, browser, GPU, drivers, etc. This lets a site running JavaScript to generate a hash unique to everyone with your specific combination of software and hardware and uniquely identify you without cookies.