So for KYC this is absolutely correct. They cannot spend your #btc because they won't have two keys, however, they WILL know who you are, and have complete access to all your receive/change addresses.
If their security ever fails, your entire stack will be broadcast for the world to see. EVEN IF you buy non-KYC #Bitcoin if you send it to one of those multi-sig addresses, the xPub will reveal that you own it.
The only way to get anonymity again will be to either coin join to a new multi-sig setup, or you might be able to do it pegging into liquid then out of liquid. Still working through that one.