In bitcoin, there is no way to do CoinJoin trustlessly - at least at the protocol level.
Why so? A link?
To me it looked quite simple:
The signatures, one per input, inside a transaction are completely independent of each other. This means that it's possible for Bitcoin users to agree on a set of inputs to spend, and a set of outputs to pay to, and then to individually and separately sign a transaction and later merge their signatures. The transaction is not valid and won't be accepted by the network until all signatures are provided, and no one will sign a transaction which is not to their liking.
No risk of theft at any point.