The only way to protect privacy is by trade face to face, but I'm sure people are discouraged to do it because it's not secure.
I said the same thing to myself; unless I'm mistaken, even if you trade face to face or OTC, there's no guarantee that the bitcoins you buy don't come from coinjoin or other tools. On the other hand, even in OTC, someone has to acquire them first, and I think that most of the bitcoins traded in recent years have come from CEX.
If the bitcoins have an AML tag, they are first blocked on a third-party wallet and then transferred to the exchange's shared wallet. The exchange explains this by the complexity of storage on different wallets.