> unless you give them a key to match you across apps

Eg by running standard Android? That doesn't have eg secure app spawning, so apps can profile app initialisation data AIUI

And probably 10 other things behind the scenes that GrapheneÓS plugs?

Exactly, people are going to be logged into these apps with trackable identifiers. You can see it with tracker control on android, download a new app and see existing apps report things to new trackers, which seems to be happening at the sdk level.