A disclaimer that a technical vulnerability exists isn't some kind of implicit invitation for a company like Google to use that vulnerability for their benefit. It's true that it's technically possible to track users using a private browsing mode, but it is not ethical.

If you have a car with a broken lock, that's not some kind of open invitation to burglars to steal whatever they want from your car.