The browser provides FLOC IDs. How do you think other advertisers convince browser vendors (and particularly Google) to include support for their FLOC's?
Antitrust most likely. FLOC + anything else is probably identifying too. If there's a couple thousand FLOC ids, you only need one more identifier with that level of specificity to form a unique identifier. IP alone might be enough