yeah, the thing that stops browser fingerprinting on the threat level of ad companies is firefox's built-in protections (which are in fact stronger in incognito) and ublock origin; and umatrix, full script blocking, and probably prayers on tor's level.

what incognito does is it breaks apart your chain of regular cookies. those can still slip through a lot of these tools, especially when they're first-party, but they're also kinda low-tech because of being first party most of the time (while the third party ones are easily blocked by other tools). that way the trace you leave behind is not one long thing, but many small ones that are hard to connect.

incognito is just one layer of defense but it's an important one