You can't reject someone depositing to your address. So a tumbler can taint whichever addresses it pleases

You aren't tracking coins with the ledger, only totals. So address A can have 10 btc, tumbler adds 5 to A, then A transfers 5 to B, 5 to C. If C is an exchange, does it consider that A is still holding 5 tumbled coins? Or does it say B has the tumbled coins? Or does it reject A's offer of 5? Feel free to shift values such as A having 100 BTC, receiving 0.01 tumbled BTC, & wanting to send 1 BTC to exchange

Also hard to track something like A sending tumbled coins to B, which triggers the owner of B to have C send non tumbled coins to D. You can even have this service offered at an exchange rate, so D receives less than B did

Easiest solution is to just taint any wallet that has ever had a coin from a known tumbler added to it. It's harsh and a malicious tumbler could mess up famous wallets, but easy to implement and "safe" to a point.

A harder solution only allows them to withdraw up to the number of coins you can verify were not tumbled. So if some malicious tumbler deposits 0.000001 coin in your wallet you can convert all but 0.000001 of your wallet's value at an exchange.