Samourais position was always "if you use our node you're trusting us" which seems like a reasonable tradeoff when the service you are providing is legal. But their retention policy was never clear and it seems there were some XPUBs on their node when it was seized.

The xpub was just one of the many privacy issues Scamourai had.