An exchange BISQ hasn't any KYC/AML, hasn't limits, doesn't verify and doesn't know your IP because it works via Tor. Also for example Binance exchange has limit 2 BTC/day for unverified preson for any coins ($30-40K per day or ~10 M$ per year at this moment). And Bitfinex hasn't withdrawal limit for unverified preson, except USD, EUR, USDT. Yes, these exchanges will know how many coins bought by your account, also exchanges will know generated secondary stealth addresses and can see money on them.
1. But exchanges can not match your account and your person, because you are not verified.
2. Also any next money transfers after withdrawal make it impossible to know now is it your new addresses and money, or already another person has them.
So this is not such a big problem if you use Binance/Bitfinex/..., and there is very small problems if you use decentralized autonomous exchange BISQ. Let me remind you, we talked about any private/non-private coins.
The problem isn't KYC/AML for coins, but that exchanges and governments can perform chain analysis on SOME coins.
Also, IP masking is trivial to add to any coin, so not sure why that is a selling point. Onchain anonymity is the hard part and that's where the majority of coins that have privacy claims fail.
The exact scenario that I'm talking about is I depostit my funds on an exchange, they scan the blockchain and see that a private tx happaned and report it to a regulatory agency and hold the funds. With Monero every XMR is indistingishable from another Monero, so there isn't this problem. Even if Spectre coin is anonymous, which I highly doubt, they failed to make every coin indistinguishable from the next, which means anyone can single out a private tx as supicious.
I'm guessing the vast majority of tx are not private, so you have a reduced anonymity set anyways, so a timing attack to reveal identity is more likely.
As long as you fail at fungibility, you will have residual effects on privacy. Unless of course you are discussing quantum money, which doesn't exist yet.