I'm not talking about revealing the xPub. But if you have a tax inspection where you need to justify some income in fiat, that came from a Bitcoin sale, you can get asked to prove the sale by providing the transaction id and the bank deposit receipt.

Even if you don't reuse addresses, it's trivial to deduct what's the change address or the paying one. And that affects your privacy.

The problem here is really the fiat payment, that leaves a trace that could force you to reveal at least one transaction id.

See #940521 for the details.