In theory, I see your point about Google not having direct access to a site's first party cookies, but Google is clever. If you monitor the requested resources when you visit any site with those cookies, you'll notice a request to http://www.google-analytics.com/__utm.gif? followed by parameters sending the values of those cookies to Google. So, they are tracking said cookies.
So I think Analytics "sees" 80% of your browsing but it's multiple fragments, each going to different analytics domains. It's never seen as a single user.
Can't Google make certain (admittedly imperfect) inferences based on seeing the same IP address visit gmail.com, then AllThingsD.com, then CA.gov, etc? (All of which use Google Analytics) It doesn't take rocket science to place a high probability that the the IP address that visited gmail is also me across all those domains.
Why go through all the pain of setting analytics such that: it uses per analytics domain first party cookie, serves the javascript and the tracking gif on google-analytics.com (no google.com cookies are transmitted), but they would then try to reconstruct user behaviour based on IPs?
That would be quite deceptive (and might not allowed by the FTC and the privacy policy).
And they can already do global tracking with the doubleclick cookie. But it is explicitly not allowed to link it with other data without consent.
Edit: by the way, thanks for your questions, I never really digged into this and also at first assumed they would have access to a lot more information. But analytics is actually pretty well designed.