This is true of any centralized coordinator, if you can't trust them not to Sybil then using the tool is pointless.

You have pointed out the only caveat, in that Samourai could do so more cheaply because they can wield non-Dojo users as Sybil attackers in a sense.

Any time there is a centralized coordinator they could easily be all other participants in a mix and de-anon your spend.

Wasabi could do the same, and could do the same only for inputs flagged by whatever chain surveillance company they fund.

It's all trust.

This is the single biggest issue with Bitcoiners not being willing to do privacy at the base layer (like Monero) and instead pushing it to the app layer - we re-introduce trust where we technically do not have to.

And no, JoinMarket is not a solution as it's easier to Sybil.