You’re the one speculating. You can analyze your network traffic to ensure it disabled, and as people have done and verified that it is disabled. Those are standard Google Ad trackers. Any app with ads has them, like Sync for Reddit did and Sync for Lemmy does.

If there’s truly XSS vulnerabilities in lemmy that would be really bad. It’s one of the first things an attacker will try and it’s so easy to protect against.