I would even say the worst case scenarios for privacy are more prevelant in Lightning (Custodial and LSPs) because of it's increased complexity. Users don't know or care and just use Wallet of Satoshi. You can see this in custodial wallet download stats and the top LSPs like Acinq.
Discussion
yeah I think thats accurate.
Do you know what these wallets are that are sending via RPC? I've never heard of any of them.
I'm pretty sure Cake and Monerujo do. I don't know every specific wallet that does, but I'm I think it's common for phone wallets. It's essentially the same metadata problems as using a public node for any other crypto/Lightning. They'll know your IP address if you aren't using a VPN/Tor, the times you sync, the last block you're syncing from, and what time you sent a transaction.
I've already known for awhile that Dandelion doesn't apply if you're using someone elses node (at least from the public node you're sending your tx to - it still applies to the rest of the network when the public node sends it out I think).