Sadly, these days my threat model for anything new is basically “how will Google/Facebook use this for ad targeting?” — it's good for both a realistic level of risk (most of us are not targeted by the CIA/Mossad/FSB) and a sober assessment of the level of resources available to the attacker.

For blockchains in particular I think we tend underestimate the amount of information which someone with that kind of analytic capacity could derive, especially if they also have other data sources — for example, I would be quite surprised if the various anonymity schemes are less effective when evaluated as part of a full system against someone who has a lot of visibility into web activity (Google Analytics, Facebook beacons), DNS, email, etc.