Looking at the spec wouldn't it be possible to avoid bounce tracker classification by performing redirects through a popup or a new tab (e.g. target=_blank)?

Consider the following redirect chain: A.example -> Tracker.example -> B.example (shown below)
Since bounce tracking records are kept per-tab opening a popup would lead to the creation of a new record (for Window 2) with initialHost = "Tracker.example". On extended navigation end, when running the record stateful bounces algorithm Tracker.example would then be excluded since it's set as initialHost.

To prevent this bypass we could copy the bounce tracking record to the new tab / window.