This is why someone needs to do the research on it. Even a 20 second buffer, filled at a constant bitrate, may suffice to deter the vast majority of potential bitrate signatures that could be used to identify the stream. The status quo may already be sufficient defense.

Interesting data point on the separate AV streams. I can't say I've noticed that myself.