Most of the non-IP components of fingerprinting are pretty goofy things like browser version, device, screen size, etc. If you are dealing with web traffic in any meaningful number, you have to dip into really minute details to tell apart visitor 10,001 from 10,002.

More often than not, the details that make your device unique on one day will not stay unique by day two. Your browser might change versions, you might resize your viewport, install a font, etc.

I believe phone apps can get more conclusive device IDs via the SDK, but for web traffic cookies and IP addresses are still the only reliable identifiers. I would take any study or hypothetical about fingerprinting with a massive grain of salt if they don't keep a stable match for 30 days.