I don't know how well this would stand up in court, but the obvious difference here seems to be using "an exploit to read your local files" vs an intentionally designed API.
Neither the canvas API, nor the audio API was designed with the idea of providing funtionalities for user tracking. To me it is a clear misuse and I find the comparision to an exploit fair. I really would like to see somebody sue.
Unless it's flipping bits via radiation, every exploit is (ab)using "an intentionally designed API". In this case, audio API may be intentionally designed, but the intention wasn't to allow fingerprinting.
True, but there's still a difference between abuse via a buffer overflow "mistake" and say the overly verbose Battery Status API.
A technical difference, sure. A legal difference? I don't know. A moral difference? Absolutely not.