> There isn't really any hard bound on how much information could be leaked via these algorithms.

With ~33k cohorts, there is literally a hard bound of just above 15 bits per visit. That's still theoretically a lot if you have some other stable identifier, but practically speaking most users on most sites will have an identical cohort and it will drop off rapidly as cohorts stabilize into groups appropriate for ad targeting.

Barring the other considerations I've mentioned in the comments here, that's still immeasurably better for individual privacy than ~infinite bits per visit from stable third-party cookies.