If you're on a KYC exchange then the chainalysis aspect is always there until you do something to break it. Your question was about other aspects and the key security is the other big one.

Anytime you share the bare pubkey fits the bill here so a spend to anywhere or even a signature proving you own said sats.

Depending on how big your utxos are you may want to consolidate when fees are low so maybe that'd be a good thing to do at the same time as switching to a new withdrawal address.

i thought the whole issue was that chain analysis could link identity to be honest, but how should a spend be defined? by moving the funds to another wallet i control, of some other transaction type?

stack_harder

This is more important than just the privacy aspect IMO.

bitcoin

how bad is it really reusing addresses?

Until funds are spent from an address, there are two layers of protection for the private key. When spending you supply the ECDSA public key which removes one of those layers.