Can an App get around me saying not to track me

"If you choose Ask App Not to Track, the app developer can’t access the system advertising identifier (IDFA), which is often used to track. The app is also not permitted to track your activity using other information that identifies you or your device, like your email address."

This is the typical response to this question but looking closely, it says they outright cannot access the IDFA which is an absolute statement. Then it says they are not permitted to track activity using other information, which is not such a full stop as "They cannot access this information".

I'm asking straight up, if companies can go around it when I press do not allow tracking because if so, then what's the point of that empty layer of security?