The only way to protect privacy is by trade face to face, but I'm sure people are discouraged to do it because it's not secure.
I said the same thing to myself; unless I'm mistaken, even if you trade face to face or OTC, there's no guarantee that the bitcoins you buy don't come from coinjoin or other tools. On the other hand, even in OTC, someone has to acquire them first, and I think that most of the bitcoins traded in recent years have come from CEX.