using a CNAME to allow third party trackers seems like a horrible idea... You risking exposing cookies and other sensitives data to some third party... I guess these sites don't care.
Session tokens should be stored in an httpOnly cookie, so they're not accessible to a third party script.
CNAMEs could absolutely lead to leaked session tokens, but website owners should already be somewhat accustomed to hiding cookies away from third party subdomains. These days, lots of third party services run on subdomains... blogs, status pages, email click trackers, support desks, etc.
You can't steal cookies, but you can perform actions as the user, eg.
$.post("/api/transfer_funds", {"recipient": "attacker", "amount": 999999})