Of course but that will require to also accommodate for the fact that after N queries the circuit/endpoints changes and unless you have a unique tracking system per every "attacked" user (like an random generated ID per CSS served) or a way to store persistent across sessions, Screen Size alone won't be able to identify everyone on the TOR network, and that's my point if you disable JS (raise the security level to the max for the case of the tor browser) you will be good for the most common attacks for "APT's" you pretty much don't stand a chance unless you go "outside the grid" aka don't use the integrated browser.