That's a really good article! However, this post is not only about Web security. In fact, most of the tracking done via GDID is for what's done inside your Windows system. So, not only the browser but every app you use and how you use them. The hacker in question had some web protections in place (not as many as he should. In fact I think it was pretty dumb of him to do the hacking and everything else in the same PC but I digress), but precisely because the OS was doing the tracking it was still possible to correlate his web activity. It was easy to connect all the IPs he had used since Microsoft knew when and where that GDID number logged into a page's website. Once they had the IPs and timing they could even relate them to his Snapchat and Apple logins and posts, which was only more evidence to be used against the hacker. So, even if you had Tor on Windows it might've still been possible to track the hacker. Even if they couldn't have the IPs they could still know when he logged into an app on the PC or visited a website. If no Tor user on Windows had logged into the same website at roughly the same time it would still be traced back to him because Microsoft knows that device was using Tor to go to that web page at that hour.
Because Linux doesn't track your activity, if he had used the Tor browser it would've been way harder since it would look like any person who used Tor could've been at that website, and they couldn't be sure who and what device was doing it because there's no Microsoft giving the logs on activity, that Linux Distros don't even collect in the first place.
Putting that aside, you do bring a good point: even on Linux you should be using extra security measures, because there are other ways to track your online activity!
The article you shared is really nice and it lists ways to avoid this digital footprinting better:
Mitigation strategies include:
Browser Extensions: Extensions like Privacy Badger, NoScript, and uBlock Origin can block fingerprinting scripts.
Tor Browser: The Tor Browser is designed to minimize fingerprinting by standardizing the browser environment.
Browser Hardening: Manually configuring browser settings to disable certain features and reduce the amount of information revealed.
VPNs: VPNs are good for masking IP addresses, they are not good to mask your digital fingerprint.
I will add that there are even other things you can add to your Linux to make you even more untraceable. And because it's not Microsoft and you can do whatever you want, nobody will stop you or even know you have them installed. At least one of these is literally made by GNU, the organisation who makes the utilities for the majority of Linux Distros. These include:
MAT2 - to remove metadata from your files so when you upload them online they can't be traced to you (the app version for ease of use).
BleachBit - an app that can automate cleaning your cache and temporary files while also making sure that when a file is deleted it is deleted for good.
universal-macchanger or GNU MacChanger (this one is the original Linux only version) - spoofs your MAC adress, aka, the address your internet card comes with.
OpenSnitch - An application firewall, that is, unlike most standard Firewalls, this one blocks not only unwanted connections from the outside but also from the inside, so, it stops apps from sending information to a server somewhere if you don't want to. And you can specify that the app can access a domain but not another, for example. They have an option for blocking "ads, trackers or malware domains system-wide", so not only on the browser, but everywhere on your OS.
I'm gonna be honest, for most people you only need some of these. Unless someone is actively after you, usually just having a VPN + Security extensions will suffice because it's enough to block most tracking, and stop your data being sold to gods know how many third parties out there. Only if you have done something big, worth a lot of money, will someone bother to go deeper because searching further starts taking a lot of work and money. Maybe get OpenSnitch too because you may have apps, even on Linux, that may want to send your information somewhere. For example, the official Discord app collects a bunch of telemetry, if you use OpenSnitch you could block it while still keeping the app functional.
Note: Here's the complaint filed to the court, the primary source for the case mentioned in the article. You can find mentions of GDID on page 30 of the document or 34 of the PDF.
Thank you @just-call-me-zinnia for finding it!