Assuming a state actor with near unlimited resources (time, money & legal power), my guess is everything can be analyzed. Of course they would need to obtain data from every wallet involved in the transfers, while the base layer completely open and easy to inspect.

I'm thinking more in the sphere of what's plausible - how much resources would a state employ, to go after a random citizen who might have spend 50 bucks of BTC on a dinner, without declaring capital gains on it? For example. Not something that is nearly 100% anonymous in all cases (and requires a lot of technical knowledge), just less traceable and less worth going after. On-chain is too easy to follow, while Lightning adds just enough obfuscation to become a hassle - as far as I understand it.

Then there's the consideration that KYC is a huge security issue for end users (hacking of exchanges, data leaks, etc). A person doesn't need nefarious reasons for wanting to improve their anonymity. I didn't understand these things when I first started to save in Bitcoin. There's a lot to learn.

Thanks again everyone for your inputs!