The question is how to protect against fingerprinting?

Protecting yourself against some scripts is easy and convenient with uBlock Origin. Tracking by URLs can be handled by ClearURLs. Cookies are easy to address with containers, ideally temporary ones with per domain isolation. IP tracking can be addressed partially using a VPN or Tor.

But fingerprinting is hard. Some Tor browser configurations go as far as fixing the window size. Things like timezone, user agent or available fonts leak a lot of unique information. Any simple setup that doesn't have too many caveats?

Tor browser does that.

Firefox with resistfingerprinting also works.

https://github.com/arkenfox/user.js is militantly maintained. It documents and make it easy to use many of the features upstreamed into Firefox by the Tor Project.