It would have to be something a human couldn't engineer around. Like, adding one random extension that you don't have installed. Though, this could cause issues with legitimate sites. The problem is that if it's bogus noise, it can be removed. If it's legitimate information, it's going to screw up something legitimate that relies on it. Maybe make up an extension name that doesn't exist for every request?

They'd just remove the random string...

The browser UA is only one component of the fingerprint, and probably not the most important one.

I think you always win in that cat and mouse game. Add some fake entries to the list of plugins, to the list of fonts, ...