I believe it takes relatively sophisticated analysis (ie the kind of real world snooping that state actors do) to tie someone to a particular address without them publishing it. Just because there is this huge theoretical vulnerability doesn’t mean most blockchain transactions aren’t secret from even smaller states.