They can host all the default mirrors themselves, either by serving the actual data (with a CDN) or by redirecting requests to a 3rd party mirror by GeoIP.
I agree with the core point that tracking users via package updates is a bad idea, but I don't think this specific argument is very great.
Redirecting the requests to the closest existing mirror also obviously drastically reduces bandwidth requirements and should presumably be doable with a few (for redundancy) colocated dedicated servers running efficient server software.