The xpub can’t straight up be reverse engineered through on-chain analysis even if they know you control each of those addresses due to KYC/chainalysis, but they assume it’s all you which would be “confirmed” (by their models) the moment you consolidate them (if you were to)

Yes you can label them in sparrow and in bluewallet and specter, probably others. But it is important to note that your labels are stored locally in each program. So say you lose your wallet and your computer but you made backups, and reload it into sparrow, those labels wouldn’t be there. There MIGHT be a type of sparrow-specific backup that would carry labels over when reloaded but i’m not totally sure