> - start on device boot

Don't think it's possible on iOS, and I'm doubtful TikTok does this even if it were possible on Android.

> - GPS location (browser can access location too if given permission ofc)

Actually this AND all of the other fingerprinting methods you listed also require user permission managed by the mobile OS (iOS/Android).

In effect there is nothing a 'native' app can get without user knowledge/consent that a web app could not. If there is, it should be considered a bug for mobile OS providers to fix.