If a vector can be randomized or otherwise arms-raced vs. the remote adversary via C++, then "Chromium" is not an obstacle for Brave. Consider the case of extensions, where your point would have been valid if you'd written "Chromium extensions".
Fingerprinting can be done many ways, but most are not economic: they cost too much for the too few bits they get from the target browser. The common methods, notably fingerprint2.js, use APIs that we at Brave, along with Apple and others in the W3C Privacy CG, are taking on.
ICYMI, https://brave.com/whats-brave-done-for-my-privacy-lately-epi....