I'm going to stand by what I said: it was a bad practice from the side of ChipMixer, but it's not a flaw in the concept of centralized mixers, in itself.
If a service does everything correctly (including deleting private keys and any backups of them after handing them to the user), something like what happened to CM could simply not happen.
It IS a flaw in the concept of centralized mixers: If you are okay with sacrificing ownership to custodians, why wouldn't you recommend a custodian that can't track their users, like ecash mints or a federated chain with CT enabled? Why wouldn't you consider it a flaw that "mixer sites" gain complete access to your financial history despite fully anonymous custodians existing?
@n0nce, I'm still waiting for your explanation as to why this isn't an obvious flaw. Here's an educational piece explaining how Chaumian eCash works: