They can still cross-track based on IP or any other fingerprint worthy information. I expect this is exactly what they're doing. Doing this all on a central service makes this process much easier unfortunately...

yes, they would need to get another identifier, and that's what is done with players like Facebook.

Sorry another of my articles in french: https://pixeldetracking.com/fr/les-signaux-resilients-de-fac..., but Facebook is making it easy to integrate their "Conversion API (CAPI)" with GTM Server-Side tagging

But that should only help e.g. a web store to track you from the ad you clicked, which seems reasonable.

It should not allow e.g. Facebook to link your activity on a news site to your Facecbook cookie, because while you're on cnn.com, your browser is using the cnn.com-specific cookie jar for everything, including the like button?

The cross site tracking is done by a third party. From reading the docs, the way it works is, publisher sets a unique id, browsers send that unique id to the publishers domain, publisher forwards that (via the tag manager app engine) to the third party.