If your UTXO was created from a KYC purchase, your identity will be flagged as "a coinjoiner" once your funds become private regardless of whether or not you use WabiSabi or Whirlpool coinjoins to make them private.

In the case of chain surveillance firms, coordinators are purchasers of their data, not suppliers of their data. If a coin attempted to register, but is rejected due to a blacklist, that does inform the coordinator that the blacklisted user attempted to make their coin private, but it does not inform the coordinator anything about the IP address or other coins in their wallet; One input could fail to register for coinjoin while the others succeed.

No toxic change is definitely the main benefit. Any change created by postmix spends is able to be recoinjoined for free as well in Wasabi, so you only ever pay the coordinator for privacy a maximum of one time, not every time you spend.

As for attackers remixing, the economics of Whirlpool is designed so that mining fees for all 5 participants are paid by the new participants. This makes it cheap to stay in the pool and costly to enter/exit it. This places legitimate users at a cost disadvantage to the spies, since the spies never intend to exit the pool.