Let's play through your scenario and assume they are a bad actor.
- I initiate a mix of 2M sats in the 1M sat pool
- My random Tor IP is tagged on both premix outputs
- As a result, each one of those two mixed outputs are tagged as one user with the originating Tor IP
- After each one of those outputs are mixed, they now have a 1 in 5 chance of knowing which output I am.
- To demix me here, they'd need to know who the other 4 outputs belong to. Even only knowing 3 of the 5 outputs means that they have a 1 in 2 chance of knowing which output belongs to me.
- This becomes exponentially difficult to follow f I remix 2, 3, 4 or more times.
- Whirlpool's design makes it extremely difficult to sibyl attack it, by charging fees for all new incoming liquidity.
Do you see how ridiculous your claim is, given how many Whirlpool users run their own node?
The promise of Whirlpool is on-chain privacy. It's verifiably the most private way of using bitcoin today. There is no second best alternative. From a privacy perspective, the one thing you rightfully point out is that the coordinator is currently centralized, so you have to trust they're running the same code that they've published.
In a few months, you will be able to run your own coordinator and gain access to the same liquidity pool as everyone else, thus eliminating this as a concern.