I was curious about the keychain issue too actually - as it seemed strange for Apple to just leave that vector in place with no protection. Turns out they did a

I was curious about the keychain issue too actually - as it seemed strange for Apple to just leave that vector in place with no protection. Turns out they did actually change it eventually. As of iOS 10.3, the relevant keychain data is cleared when the apps which have access are uninstalled. Thus, if ALL Uber apps on the OP’s phone were uninstalled, the only known/allowed method is via the IDFA. This is most likely since Uber has promised to follow the rules. If any other Uber apps were still installed though, that would also have maintained the unique identifier. Apps made by the same “team” can share keychain data (keychain access groups), and there is another ID - the vendor identifier (IDFV) which will only reset if all apps made by that vendor have been uninstalled. It may even be possible for apps to share files if under the same team ID. So if you know what you’re doing (resetting the IDFA), it’s pretty easy to prevent. Just not many people do.