That, I suppose, is why ad-companies typically invest in anonymization. It may not be perfect, but it is good enough in terms of reaching an acceptable balance between respecting privacy and someone being able to monetize an app or a website imo.

Anonymization of data is largely impossible. That's an opinion of many data protection experts. Combining datasets, using open-source data from gov't sources and likes allows to "single out" individuals in no time. Further, what industry does is largely pseudonimization, not anonymization. Anonymized data is not under the scope of GDPR, whereas pseudonymized data is.