CNAME cloaking is only the first of many possible mitigations. CNAME flattening would be the next likely angle of attack.

Advertisers can very well get websites to run "cloud functions" at the edge (with Fastly, Cloudflare, Netlify, Vercel, AWS Lambda etc) under the first-party domain, and the content blockers (native or not) will be none the wiser. This is similar to how content blockers struggle to block ads served from first-party domains on YouTube and other Facebook properties.

Exhibit A: https://github.com/samkelleher/cloudflare-worker-google-anal...