That's true, and I certainly don't do it all the time for this reason, but it highlights another way these heuristics can be fooled. Let's say I'm paying from a P2SH address to a merchant or service who are also using a P2SH address. I redirect the change to ChipMixer on a P2PKH address. According to these sites, this is a low privacy transaction because it is obvious which address is the change (the same address type as my input), when in fact they are completely mistaken.

If fooling these kind of sites is your goal, then in addition to using mixers, coinjoins, and other privacy enhancing methods, then you should also use a variety of transaction types to obfuscate what's change and what isn't, what's a payment and what isn't, and which addresses are under your control.