They can tell that a particular IP sent a request to their servers, but they can't correlate different requests to the same underlying entity without cookies. Simply saying "they track you" is misleading.
I guess this was about scripts and fonts (because others are obvious cases).
I did a test, beside IP address also User-Agent, Accept-Language and Referer headers were sent.
Perhaps not good for very precise finger printing but still more that you claimed and can be cross correlated with other requests with more precise information.
Google has claimed that they do not use this cases for tracking. One can believe this statement, or one can prefer to not do.
How can you cross-correlate them? Most people are viewing the internet from behind a NAT, so there isn't a one-to-one mapping between IP address and person.
Pretty much all of those fingerprints require the ability to run javascript on the client side. Getting static content from Google doesn't allow them to do any real fingerprinting. Obviously, if you're executing arbitrary code provided by Google, they will be able to track you pretty much always.
You cross correlate IP address and request header parameters (such as user agent, language etc) with previous requests (or future requests) with the same configuration but with known identity.
It does not give you perfect match but is much more precise than just the IP address and with limited number of users would be probably sufficient to distinguish different users behind single IP address.
I think you're overestimating the entropy of the request header parameters (assuming no cookies). How are they going to distinguish me from all the other English-speaking Windows users using Chrome? True, it is better than nothing, but I'm not sure what you could do with such low quality tracking data. You might be able to do something with that, but I can't think of any possible way to use that to violate my privacy.
To clarify it further, for the case I described, I did not assume a user that actively tries to suppress the signal to Google, but assumed a user that only does not visit Google search (or any other its services).
I then assumed that at certain moment this user can be uniquely identified (by AdSense, Analytics etc).
Then accesses to pages without active tracking but with links to Google fonts or other passive API can be still identified with high confidence given the access happens from the same network.
I do not know if such extra signal is interesting for Google, but it can be acquired. Also mind you that using an ad blocker is also a signal and can be assumed from the access pattern.
The same logic applies also to an user who uses ad blocking but still uses limited Google services.
Again I do not know how much Google finds this kind of signal interesting but it is possible to collect it.
