with GPU finger printing cookies are least of my concern now days. Cookies are about as good as a web session it should be discardable if needed.
Yeah but once the attacker get access to the JS they can do whatever. That is why stop using CDN for your jquery or react libs!