Your points are valid. I definitely agree that your purchase at a CEX with KYC links your ID with the certain TX forever.

It’s a little more complicated with TXs afterwards when you either (1) withdraw bitcoin to *your* another address, (2) coinjoin , (3) send bitcoin to * other* persons address.

The consequences of those actions depend on how the government or other entities interpret it.

Some govs will punish coinjoins, some govs will consider every withdrawal as if you send to your own address, some govs will not care at all (like in Portugal).

So, your location and your citizenship matters a lot.