FCMP++ and Seraphis are being worked on and will change this though and allow L2s as well.
OK, that sounds like some interesting development, curious to see how it plays out.
Lightning leaks too much data. Receiver privacy is bad and amount privacy is not guaranteed from larger routing nodes. It's also trivial for large nodes to save all transaction data going thru them and break them later. What is worse is that most Lightning users are on custodians or using LSPs which provide no privacy.
Receiver privacy is already getting much better with BOLT12, but I will agree with you here yes, lightning still has work to do here regarding the usability of self custodial solutions. You are also right, if all your transactions go through a few large nodes, the current lightning encryption will also not protect you from post quantum deanonymization.