They simply have websites use first party cookies, send the data server side to data harvesters, tie it all to a global user profile using either identifiers from the website or from fingerprinting and then serve targeted ads.
i.e. Conversions API (Meta), Server Side GTM (Google)
I would be surprised if most advertisers would even be interested in this topic API.
A basically permanent ID. Unified ID2 is one version of this.
The 3rd party cookie ban and heavy pushback against alternative solutions suggested by Google just pushed advertisers into going an even worse route privacy wise.
This is legally tricky because GDPR and similar legislation requires getting explicit consent from users for this to happen. Currently this is not very well enforced (imo) but it seems likely that enforcement will become increasingly stringent in years to come.
That honestly sounds like circumvention of unauthorized access. That's just breaking software protections.