Correct, storing PII is against GA’s TOS. Which doesn’t at all mean it isn’t ingested somehow or another (and Google can trivially integrate it back to a person if they wanted to). PII is a very malleable term depending on the jurisdiction.

So long as website operators are creating URLs and the data layers published into analytics there’s no way to ensure the data is truly anonymized. It just takes one slip up with a username being placed into a query string, or some other small mistake. In many organizations marketing runs the analytics, and they try to do as much as possible without developers who might notice these types of errors.

It could be interesting to have browsers avoid sending user agents and otherwise minimize HTTP headers to a list of analytics domains.