Theoretically, server-side analytics could use the user-agent strings and other headers in the request to have infallible analytics. In practice, a lot of server-side analytics in practice rely on third-party tracking scripts (like Google Analytics) and other such practices that get blocked by tools like Privacy Badger, etc.

Perhaps, and this is likely the case with most users. But there still exists many users with extensions disabling fingerprinting and such.

I wish Cloudflare would publish stats based on user agents. They must have a good idea about the real numbers