They self sybil and fill Wasabi with fake volume. Very easy for them to link inputs and outputs.
Just to keep fair criticism here, sybil attacks in coinjoins are easily detectable, in order for the attack to work efficiently in deanonymizing a certain input -- the coordinator needs to refuse connection confirmations from all other participants, so if your input has not been spent before and the coordinator rejects your connection it's safe to assume that it's preparing for a Sybil attack on an input it identified earlier in the current round.
Obviously, at this stage, it's hard to tell if enough adequate users still use Wasabi to spot sybil attacks.
In *theory* couldn't all their transactions be sybil attacks. All inputs except 1 for each mix come from them / known source. Every time the coodinator sees something coming in it has local wallets fill the rest of the space so to speak.
Yes there is a large cost and complexity. But we are talking millions of dollars at most, not an unobtainable amount of money for a business.
-Dave