Yes, privacy is the main concern. It is also that if one of the keys was broken because of bad signatures with weak r values or because you simply leaked the private key, then the xpub can be used to derive all other private keys in the wallet. On the theoretical side it also makes you vulnerable to quantum computers (similar as reusing addresses does). And someone may send you 0.0009 BTC just to annoy you (They were sent today).
Aside from that, there's no way to tell what exact key index structure was used to generate the child keys. If they went with what's recommended (m / is_change / n) then a generic solution might work, but wouldn't rely on accuracy. Is that the key index used? Are they hardened child keys, or no? etc...
Yes this could be an issue. Mycelium and myTrezor lite assume standard structure m/is_change/n, which seems to be the case here (at least I can see a lot of transactions). Note that hardened child keys do not work with xpubs (this is the reason why one uses hardening in the first place). So you can at least exclude that.
You can also use bip32.org to generate the addresses. Then you can choose the path by hand. E.g., "Custom" and m/0/0 gives you the first used address. It is not really practical, though. You need to generate the addresses one by one and then use a block explorer to check the balance.
EDIT: electrum also works: "Recover wallet or import key" (under File->New/Recover) and then enter the xpub in the seed field..