The provider a) is the other parts of the internet (think big cdn) and b) they communicate with other data brokers via a side channel instead of via cookie syncing.

This is already happening with large web publishers.

But even if they do that, how can they tell it is the same user on two different domains?

I wouldn't know, but fingerprinting is a thing and is bad enough.

Do you have a great way to block every fingerprinting method?

Firefox seems to be on the case. There is really no good reason to give any means for a website to fingerprint a browser.