most traffic goes through large public nodes and only involves a couple of hops. if you’re tracking the large, public node in the middle and you see 1M sats go in and 1M sats go out within milliseconds you can have high degree of confidence theyre connected
similar to how people are tracked through tor, ie timing attacks.