They can just flag all Tor users as high risk. They don't strictly need to fingerprint them when it's generally fine for websites to just block signups for Tor users or require further identification via phone number or something.

You want fingerprinting to identify low risk users to skip the inconvenient security checks.