From the PING review:

What data on user device is revealed and what is the risk of fingerprintability?

This spec appears to define a reading system user agent string epubReadingSystem. Is there still a navigator.userAgent or similar? Is this a replacement or a duplication of that feature? There is also ongoing work to limit or deprecate user agent strings on the Web platform -- to make it an explicit opt-in rather than always disclosed in great detail. At the very least, we need to recommend that user agent strings have entropy that is strictly limited as necessary for debugging and compatibility. And it should be noted that epubReadingSystem reveals information about how the reader is reading the book, potentially back to the author/publisher of the book, unless scripting is more strictly limited.

As every EPUB is considered a separate origin, the threat model here is: can an author/publisher of multiple ebooks learn from these configuration characteristics that the same user is reading both of them? And on information disclosure (perhaps because the ebook publisher already knows the exact customer who purchased that particular copy of that book), does the publisher learn something about the customer's devices or software choices?