Most traditional adtech, used to targeting attributes, is quite puzzled at how to use this at the moment given they'll all need to invest in machine learning because these IDs aren't interpretable.
The specifications of this stuff are all in the open.
That's the key though, isn't it? While I can see that the intentions may be good, this isn't being released into a vacuum, but rather to a world where all of that other tracking infrastructure already exists.
One day I receive a request that says you are group 12345, in 1 hour you are 12346 instead because the algorithm recalculated your FLoC... Not sure what anyone can tell about that without knowing the group ids meanings, which likely not even google will know since this is going to be a clustering algorithm anyway.
As long as browser fingerprinting exists it will be possible to track the FLoC cohorts a person belongs to over time and learn much more about them than a single FLoC cohort reveals.
But AFAIK, FLoC is only replacing third-party cookies; browser fingerprinting will still be possible.
Effective fingerprinting makes everything impossible. Even if there were no 3rd party cookies and no FLoC, ad-tech can still use fingerprinting to bucket you based on your browsing history. This isn't a criticism of FLoC, this is a criticism of unwanted fingerprinting.
Sites that know who you are (e.g. because you log in) gain even more info, if they previously only knew about your visits to that site.