As as I understand, declining to use the ATT framework just means they don't share the system advertising identifier (IDFA). That does not mean the information they do share cannot be fingerprinted.
Losing access to IDFA is the technical mitigation, but the ATT prompt also places policy obligations on developers. Preventing tracking technically entirely is a technical dead end. There are too many sources of entropy. ATT primarily operates at a policy level.
As as I understand, declining to use the ATT framework just means they don't share the system advertising identifier (IDFA). That does not mean the information they do share cannot be fingerprinted.