What I'm not following is that you say:
> In this new world, evil.foo.com and evil.bar.com are still third party to each other, and so there's no way to sync identifiers between them, even though they're both operated by evil.com.
But in your original 1-4 description, foo.com and evil.com already were third-party to each other. So apparenty that was not a barrier? Your original description doesn't actually mention mention any shared identifiers between evil.com and foo.com, just that evil.com would use a referer header to see that the rquest was coming from foo.com.
Won't this work exactly the same way with evil.foo.com and evil.bar.com?
Your original 1-4 stopped working because FF and Chrome stopped letting evil.com set cookies at all when loaded from foo.com. That is the restriction that broke 1-4 (it wasn't other restrictions that were in place when 1-4 was working fine), and that is the restriction you get around with evil.foo.com, restoring the situation where your 1-4 steps worked.
What am I missing?