Boltzmann score is useful in case of a malicious coordinator weakening the anonymity set, to the point where only a minority of the inputs and outputs are not registered by the coordinator.
Then that would mean Whirlpool has zero "Boltzmann score" since the coordinator is trusted to choose every participant for the round.
You do have this information if you partner with blockchain analysis.
No you don't, Alice could have any combination of coins. "partnering with blockchain analysis" doesn't penetrate the anonymity of her open source client.
but even if I need a friend for protection
You don't need a friend, as I mentioned before, you can singlehandedly test for a Sybil attack yourself by registering 2 inputs.