UTM tags in that sense are collected on the client side by tag manager or google analytics, which would be blocked by an ad-blocking extension anyways. UTM tags can/often are collected by the website themselves to do first-party near-100% confidence campaign analytics.

So what you're saying is that there is plenty of other spyware (some of it server-side) that freeloads off those UTM query params? Sounds like another good reason to strip them?

That may be the case for blog sites, but big companies just directly ingest it into their application or internal analytics platform for a dashboard of which sources were the biggest contributors. Is that a bad thing? Knowing that traffic came from x source so that they can properly route resources in the future to the those high-impact sources?

I wonder what would happen, if a significant number of internet users starts faking these. Either with random data, or "poisoned" data/referrers.