I guess the question is... how? Browsers isolate what they know about you to domains. When you go to Gmail, it doesn't tell Gmail that you have a Hotmail email.
As far as the browser knows, lemmy.world and lemmy.ca are as different as hotmail.com and gmail.com. The token that knows you are logged into lemmy.world is not sent to any other site, that would be a huge security risk. And the browser doesn't know what is being stored in the cookies, just that it's there and it should only send it to the domain it came from and never another.
I don't disagree that this is a big problem. I just don't know how it would be solved while keeping the fediverse decentralised.