I think you're missing that setting cookies alone isn't what allowed evil.com to sync identities. They needed to set the cookie from one site, and receive that same cookie when the user visited a different site.
With CNAME cloaking, it's true that EvilCo can set cookies on both evil.foo.com and evil.bar.com. But when a user is on evil.foo.com, there's no way to make a request to evil.bar.com that includes evil.bar.com's cookies. This is the mechanism that stops syncing identities.
Does that help?
What did banning third-party cookies actually stop then? Nothing?
So whatever they were able to do before banning third-party cookies, why did banning third-party cookies matter at all?
The whole point of the CNAME as described is to get around third-party cookie bans. If getting around the third-party cookie ban doesn't actually help -- that seems to suggest the third-party cookie ban in the first place didn't actually do anything, if getting around it doesn't give you anything? no?
That _does_ help. It adds noise to things and helps us shift our focus to stopping fingerprinting.
What I'm not following is that you say:
> In this new world, evil.foo.com and evil.bar.com are still third party to each other, and so there's no way to sync identifiers between them, even though they're both operated by evil.com.
But in your original 1-4 description, foo.com and evil.com already were third-party to each other. So apparenty that was not a barrier? Your original description doesn't actually mention mention any shared identifiers between evil.com and foo.com, just that evil.com would use a referer header to see that the rquest was coming from foo.com.
Won't this work exactly the same way with evil.foo.com and evil.bar.com?
Your original 1-4 stopped working because FF and Chrome stopped letting evil.com set cookies at all when loaded from foo.com. That is the restriction that broke 1-4 (it wasn't other restrictions that were in place when 1-4 was working fine), and that is the restriction you get around with evil.foo.com, restoring the situation where your 1-4 steps worked.
What am I missing?