(Though that analytics platform itself does do device fingerprinting, inasmuch as detecting phone model, OS version etc -- I assume no individually identifying stuff like IMEIs, but who knows what a bad actor can do with sufficient entropy?)
They use firebase for push notifications. GCM (Google Cloud Messaging) has been moved to firebase, and it can now also do Apple notifications I think so it makes sense to just stick to one.
Except you don't need to import Firebase Analytics to use the messaging.
And, same as the Facebook SDK situation earlier today, Firebase SDKs will do stuff when the app loads whether you reference them or not.