I very much agree with most points you're making. I'd however like to place a footnote here;
If you want to just send coins to a mixer site, cross your fingers, and hope that its not a honeypot logging the links between inputs and outputs, then I suggest that you click the links in my signature and try Chipmixer. Chipmixer is convenient, and it unlinks your transactions on the public blockchain. Javascript is not required.
If you want trustless privacy, that is a complicated subject beyond the scope of this topic. The best I can say here is that as Lightning grows, it will render all these questions obsolete for most use cases: Blockchain spies cant trace transactions that never touch the blockchain!
This is still a scenario which one -- who takes his privacy *extremely serious* -- should consider. We have yet to see any proof Chipmixer isn't a honeypot per se either (Though- it'd be pretty much impossible to prove or disprove anyway-). While I might believe that Chipmixer is acting in good faith- it'd be weird for me to tell others they actually are, without any immutable proof.
Therefore, if one is using Chipmixer for anything other than unlinking their inputs for the commonalty and some improved privacy, i'd highly suggest he thinks twice about such a scenario.
Well the OP mentioned a Tor versus VPN analogy so going by that scenario you can look at NordVPN for example. They employed third party independent external auditors to check their no logs policy and they passed it with flying colours after a thorough check. Others VPNs such as PureVPN have also stated a no logs policy but do indeed log for whatever time the connection is valid, others have their own structure but do log various things even though they sell their service as a
no logs policy. As mentioned NordVPN did pass with flying colours as it did what it said on the tin.
Back to Chipmixer, to my knowledge so far no claims have been made with regards to users being (selective) scammed and that is a great thing for reputation sake but would a third party independent external auditor checking things over and giving their verdict be enough to reassure those that are not convinced about its effectiveness for anonymity?