Personally I don't see why we should treat browser/web vulnerabilities that are being abused for tracking any different than every other security vulnerability... apart from the discussion being warped by Doubleclick pumping out new browser vulnerabilities, baking them into web standards, and marketing them as "features" to be rapidly adopted.
Complete agreement; anything that can be used for tracking is a security vulnerability. That doesn't mean it's a top-priority security vulnerability on par with remote code execution, but there's already a whole vulnerability category for "information disclosure".
