Besides the vendor, you can fingerprint the extensions list, as well as various limits https://browserleaks.com/webgl. Also webgl isn't fully deterministic across vendors (similar to audiocontext, which is affected by compiler/FPU implementations), so you'll get minor differences in output due to differences in rendering pipeline/implementation.
Are you saying it's possible to detect VMs in the browser without using the WebGL vendor? Mind sharing some resources?