They're the carrier: they know exactly at every time what IP:port belongs to each phone, otherwise they couldn't send the response packets back to the phone.

But they have to communicate this to the advertisers in the RTB bidstream, in a way that advertisers can decode to a unique subscriber identifier (or at least unique enough)

Sending just the IP would be useless, as the publisher already has the IP address (and sends it to bidstream, although it is truncated for privacy) so there would be little incentive to pay for the carrier data.

I worked in adtech for a while, and designed a system similar to this for a large UK carrier, although it never ended up being implemented as carrier was worried about optics.