Where's the flaw? All those outputs are private.
There are 262 input and 294 output collaborators, 5 coinjoin exit merges and 3 address reuses.
It is basically something like "I believe that those Utxos belong to the same person/entity" obviously there are some cases where there is no doubt, but there are also cases where there may be doubts
Their business model depends on the latter. It is utter guesswork. If a criminal mixes their coins with several individuals in a coinjoin, you can't seriously claim that every single output is now considered tainted, unless you broke the coinjoin (i.e., you were all the other participants).
A mixer wouldn't provide you any privacy since they are a trusted third party, you would just end up having your coins stolen.
A mixer is a service with sole purpose to increase on-chain privacy. The required trust doesn't change that fact, nor do the instances of mixers which were either scams or were confiscated by the authorities.