Apple have been very clear about you being responsible for the SDKs you use and while the technical limitations are only about IDFA Apple have also stated that other methods of fingerprinting are not allowed when the user asked not to be tracked. Thus, App A that uses SDK B can be banned from the App Store if the user asked not to be tracked but B still tracks using something like fingerprinting.