You can Coinjoin all you want, but if the final destination links to you in anyway - IP address, name, address, browser, operating system, patterns etc. all the Coinjoin is useless because government blockchain analysis can connect the dots (for e.g).
Picture coinjoin as a black box, where coins enter and leave the box as new coins. Let's make the hypothesis that each of the inputs is equally probable to create each of the outputs for the sake of simplicity (just like in
this whirlpool coinjoin).
You see, you're right in the sense that all of the inputs have a slight connection with all of the outputs, but that's not the point. The point is that you can't match inputs with outputs, to de-anonymize the coinjoined outputs. Blockchain analysis is incapable to connect the dots, because first and foremost
it relies on guesswork, and secondly good software (like Sparrow with Whirlpool) comes with anonymization techniques that hide IP address, OS, and other fingerprints, uses Tor etc.
What if you do everything right as above. You make an online purchase but your delivery address is included in transaction. Can't they just connect beginning & final transaction. Sure it'll take them a bit to work out, but that black box you're referring to is still transparent in a block explorer. Sure, if you buy non-KYC Bitcoin you're sweet. there's plausible deniability on how or when it was acquired.
If you use Monero, the black box in the middle isn't transparent. so they can't connect the beginning and final transaction.