>Meta devised an ingenious system (“localhost tracking”) that bypassed Android’s sandbox protections to identify you while browsing on your mobile phone — even if you used a VPN, the browser’s incognito mode, and refused or deleted cookies in every session.

https://www.zeropartydata.es/p/localhost-tracking-explained-it-could

These are the things I have learned from this story:
1. The android "sandbox" system is a meme
2. VPNs are worthless
3. You should install as few apps as possible
4. This is only the tip of the iceberg

Am I correct with my assumptions?