Ad targeting is much broader than that though. Even with encrypted data you can match keys to profiles. You just don't know who that profile belongs to and you don't even need to know the contents of that profile. The whole point here is that you can treat the system like a black box but still work with it in a useful way.
Brave has proven that targeting is not always the best answer. They did an analysis on their own platform, their CTR is very very good and they do not compromise privacy in any way and still deliver ads (opt-in).
Studies? This is CTR we're talking about. It doesn't have to be a research paper to show what's the average CTR, advertisers know it beforehand, they just made the info public.
