not really if you do proper UTXO management it won't be linked to any BTC purchase info but if you're buying stuff and having it mailed to you or otherwise linking those UTXOs to yourself, AND you are under targeted surveillance, they just have to contact one of your exchange counterparties to dox the entire UTXO cluster. as you say, its pretty fragile privacy.