I think it is less about a server fingerprinting a client and more about one website using broken browser isolation to fingerprint other websites being visited.

I think it is less about a server fingerprinting a client and more about one website using broken browser isolation to fingerprint other websites being visited. In the example, they leak whether a pixel is black or white by scaling it to fit the full canvas and then triggering 200-400 renders.