but using change addresses is absolutely a brilliant financial security advice,
I strongly doubt that many crypto users use this financial advice, as well as not everyone has a hardware wallet. I won't say anything about other things. This is obvious and is used by people who really understand how and what works in the crypto environment. The rest are absolute lazybones, limited to having an online wallet in a centralized service. If they have such an attitude to the storage of funds, then what kind of privacy can we talk about?
Online wallet, one mail for all services, one password for all services - this is the harsh reality of most crypto users.