There may actually quite a lot of PII in the HTTP headers: IP address, Accept-Language, and User-Agent being the most obvious (especially mobile browsers often send a ridiculous amount of PII in the User-Agent header).

There's also some very useful information that's hard to get from HTTP headers, screen size being the most obvious one.

I don't think it's fundamentally more privacy-friendly. The real problem with JavaScript trackers from GA and ad networks is that they'll try to profile you with tricks like font metrics, audio API, set cross-domain cookies, and whatnot. But that doesn't apply to either Plausible or GoatCounter (and in the case of GoatCounter, the count.js script is intentionally unminified so it's very easy to see what exactly it does if you care to do so).

GoatCounter runs fine on constrained environments; it has a RES memory size of about 30M, and for the first few months goatcounter.com ran on a $5/month VPS which was mostly just sitting idle.