Even with Google's auditing, there are sensitive things that Google (hopefully) can't detect, but others can.

For example, insurance claims. I hope Google isn't tracking enough information to test for correlations between FLoC cohorts and insurance claims, but insurers will have access to that info when customers visit their site to pay bills.

Perhaps they'll find they can more accurately anticipate customer's claims from their FLoC cohort, and use that to price new policies, thus indirectly pricing policies based on browsing history.