You're continuing to quote the post where an individual consciously decided to consolidate Whirlpool coinjoin input with toxic change. I have used Whirlpool with Sparrow, and I have never had my toxic coins consolidated with my coinjoined.
The post doesn't even demonstrate that. It only demonstrates unmixed change being consolidated with other unmixed change.
If you know what you are doing, there is nothing wrong with this. I do this literally all the time. Let's say I withdraw 0.1 BTC from Exchange X and Whirlpool it. It creates some unmixed change. Next week I do the same thing. The week after, the same thing again. There is minimal privacy loss from consolidating those three unmixed change outputs together to feed back in to Whirlpool, since all three are already linked together and to my KYC data as held by Exchange X.
Samourai and Sparrow prevent you from consolidating unmixed change with coinjoined outputs, as you say. Not only that, but in the example Kruw keeps bleating on about, the unmixed change on P2WPKH addresses is consolidated with outputs on both P2PKH and P2SH addresses. The user in question has manually crafted these transactions and moved them between different wallets for signing, or has exported all the relevant private keys and imported them in to the same wallet.
This is absolutely not a case of Whirlpool being flawed or there being any privacy leaks at all. This is quite obviously a case of a user who knows exactly what they are doing.