The thesis is from December 2017, I read it a long time ago and it does not mention Bitcoin Blender, they attack Coinmixer.se, not Bitcoin Blender.
The attack it describes requires that the mixer publicly publishes statistics on how many mixer transactions they have done over the last week (which I don't)
"In all mentioned attacking scenarios, we assume that the attacker is able to retrieve publicly accessible statistics which may be published through the centralized mixing service."
It then mentions some other flaws of Coinmixer.se necessary to identify their transactions, the most important was that they used a static transaction fee for all withdraws, on Bitcoin Blender each withdraw sent have a randomized transaction fee.
Coinmixer.se also always set a locktime of the current block on their transactions, on Bitcoin Blender it is randomized if locktime is set on transactions or not.
Further Bitcoin Blender also randomizes if RBF is to be set on the transactions sent.
