You're conflating privacy with anonymity.
The exchange knows who you are, so no anonymity there.
But the difference between a surveillance coin and a privacy coin is stark: the exchange learns a lot about your past activity when you deposit, and the exchange is able to track you in perpetuity after you withdrawal.
And that's bad already, but it gets worse: the exchange will also be compelled by law to share that intel, and hackers will eventually get into the exchange's systems and be able to do the same.
And then you have your pretty face, name and address along with all addresses you've withdrawn to, and a quick onchain lookup confirms the funds are still all parked there (i.e, you have them in self-custody).
How do you think people are targeted?
It's usually not random.