Sure but that can be completely randomized, no? like keep changing folder where cookie gets hidden, or the ID generated.
Idea really is that you can identify single device time after time. So even if there is slight change in anything like software that can be easily changed that is not good enough.
Not that fingerprints should lead straight to bans, but maybe at least heightened awareness.