Sadly, spoofing GPU vendor & renderer can be an even larger flag since they can hash the resulting image of the canvas to compare it with a database of collected fingerprints[0]
[0]: https://research.google/pubs/picasso-lightweight-device-clas...
It’s funny that trying to click on the Google Scholar link there falsely identifies me as a bot.
Until a major player gets on board. Then it works.
Apple does this by sending an imposter user agent from Safari on iPads.
If only that was expanded to iPhones, too. And then send rotating, or randomized user agents.