OK, there is a feasible way this could happen. Google would need to be using IP address plus browser device fingerprinting to identify users who visit Google Analytics sites, and would then need to be packaging that data to sell to advertisers.

I don't believe they do this, partly because if they did it would be something they would want to actively promote as a product to advertisers. Why do the creepy thing if you can't talk about it to make more money?

But technically I do believe it is feasible.