Since the tracking runs on the client now. Would it not be easy to write a browser plugin reporting fake flocs? Not sure if it would suffice to just overwrite

Since the tracking runs on the client now. Would it not be easy to write a browser plugin reporting fake flocs? Not sure if it would suffice to just overwrite the document.interestCohort(); function and have it report something trollish. Since a cohort is rather small could a botnet be sufficiently large, to create its own private cohorts and mess up a lot of add deliveries?