Grayjay/Cloudstream fingerprinting/tracking domain

Hello everyone, I was wondering if these types of apps that fetch content from internet sites are vulnerable to fingerprinting.

Additionally, some time ago I noticed that these apps, when fetching from sites, also let tracking domains pass through (I don’t know if this still happens with Grayjay or Cloudstream). If so, what are the risks to privacy? Would using a VPN, at least in the second case, be helpful?