Correct, but that's solved when the merchant does a coinjoin first and includes private inputs in the payjoin transaction.