The reason sites are adding these CNAME tricks is specifically to enable evil.com to track you across sites to sell ads. So it's not just the CNAME trick, it's

The reason sites are adding these CNAME tricks is specifically to enable evil.com to track you across sites to sell ads. So it's not just the CNAME trick, it's specifically what evil.com is doing that links accounts across sites. The bottom line is that evil.com would not be asking sites to install CNAME tricks in their domains if evil.com cannot leverage those tricks to track users across sites. That should be obvious.