Check the video. If you do three purchases and then there's a single transactions that has all the three txout in their ring sets, it's probably a sweep transaction spending all three outputs, the chance of all three selected as decoys randomly is almost zero.

If you know the address, you can poison it by sending some XMR to it and then you can identify the spend with almost 100% probability - if they choose to use them in the same tx.

So you come from "no one can see anything" assumption to "I need to do coin control to keep my privacy".