If Boltz and SwapMarket are subpoenaed, can’t they link both UTXOs via the lightning invoice payment hash?

I assume most are trying to achieve privacy from the government, but then you should also include government attacks in your threat model.