Basically, the chaff transactions go to/from wallets actually owned by people. If you analyze enough of the chaff transactions, especially when the XMR that made them up is respent, you can deanonmyize users.
This is why people recommend you do not reuse wallets often but that still does not solve the problem.
Zcash I think is secure, or is per most analyses I've read.
https://tokyo2018.scalingbitcoin.org/transcript/tokyo2018/ho...
https://arxiv.org/pdf/1704.04299/
Basically, the chaff transactions go to/from wallets actually owned by people. If you analyze enough of the chaff transactions, especially when the XMR that made them up is respent, you can deanonmyize users.
This is why people recommend you do not reuse wallets often but that still does not solve the problem.
Zcash I think is secure, or is per most analyses I've read.