Exactly. They just have to correlate device type & OS version & IP address & date/time to have a pretty good idea of which other apps (& their “unique” IDs you have).
The more they do it the more they can narrow it down, until they reach the point where they have a set of IDs that only ever come from the same device/version, IP address as well as very similar times of day.
The more they do it the more they can narrow it down, until they reach the point where they have a set of IDs that only ever come from the same device/version, IP address as well as very similar times of day.