We don't know that Coinbase limits their tracking of "bad" activity to "one hop." In fact I'm pretty sure at least one of the reported cases was more than one hop.
Part of the consideration that went into the payment code proposal was finding a way to make analysis of transactions impossible beyond one hop.
Even if they want to do multi-hop analysis, it's possible to make that unfeasible.
I don't think you understand what Coinbase is doing. For example, even with non-reused addresses, compliant participants may report their addresses to a risk-scoring service. If you go outside that "system", boom your coins risk score goes way up.
As long as these things remain associated with the coins themselves, fungibility is impaired.