Which means that the tower owners that PGPP partners with could absolutely still track users based on the IMEI if they configure their equipment to always ask f

Which means that the tower owners that PGPP partners with could absolutely still track users based on the IMEI if they configure their equipment to always ask for it. (It won't work in some edge cases like duplicate IMEIs but those are not super common). They may not be doing it right now, but if this sort of thing catches on, it is likely that they will start trying to do it.