The shutdown hook runs after the response is sent

shutdown is the last action WordPress fires, and by then the output has already gone to the client — so it is the right place for bookkeeping and the wrong place for anything that tries to affect the page.

add_action( 'shutdown', function () {
    // fine: the visitor is not waiting for this
    My_Stats::flush_to_storage();

    // useless: headers are sent, output is finished
    // header( 'X-Anything: 1' );
    // echo '<div>...</div>';
} );

It still runs inside the request, so a slow operation there keeps the PHP-FPM worker busy even though the browser has moved on — which matters when the pool has ten workers. It also fires on wp_die() and on most fatal paths, which makes it a reasonable place to record that a request ended badly.