Then, he might probably try to consolidate (in a few tries) those UTXOs separately, starting from one address and moving to the next when finishing.
That doesn't really help his privacy. If I have a bunch of UTXOs on addresses A, B, and C, for example, I could either do the following:
- A+B+C -> D
- A+B -> D, followed by C+D -> E
Either way, it is entirely obviously from looking at the blockchain records that addresses A, B, and C are linked, especially if they are clearly consolidation transactions with multiple inputs and no change output.
If you want to keep the addresses unlinked on the blockchain, then you need to combine all the UTXOs from each address separately and then pass those consolidated UTXOs through a mixer or similar prior to further consolidating everything together in to a single UTXO.