That there are so many ways to store data on a browser (including exploits) and that they expose so much information about your physical device is a big part of the problem. Even barring that, there are additional ways they can fingerprint a user. While any one thing might not be telling, when you take all of them in combination, it gets frighteningly accurate how easy it is for them to know exactly who you are.