Interesting, especially with GrapheneOS people shooting it down immediately to call them out on their baloney.

Push notifications though GMS don't use the device ID; they use a generated GCM registration ID that occasionally rotates. Who knows what Google uses internally to associate GCM reg IDs to users, but to overly state that it uses device IDs is simply not correct.

I'm not suggesting push notifications are inherently secure because it's impossible to make that determination from the outside. But their assessment is incorrect and the same privacy concerns apply to Apple.