Maybe I'm being unnecessarily paranoid, but these are the questions that come up as I'm trying to learn.
No, it is a valid concern. So I don't think you are not unnecessarily paranoid.
Bitcoin is pseudonymous by nature and it has a public blockchain. The concept of fungibility and taint is also preserved to be discussed here. Some entities flag and consider some bitcoins as bad/dirty or good/clean. Some governments maintain a blacklisted address. Some mining pool was trying to filter a specific utxo. Also, A mixer coinjoin operator collaborates with the blockchain analysis company to scan the bitcoin before they are able to be mixed.
In regard to your case, I think you have found an understanding of the matter. For further options to acquire bitcoin in a more privacy-preserving way, consider the non-KYC solution. Also, I suggest this resource for related information about Bitcoin privacy:
https://www.lopp.net/bitcoin-information/privacy.html.