Interesting! So at best you could narrow down the purchaser to one of many possible sources.
My first thought is that a large enough organization trying to demask you could do so by looking at repeat subscription purchases over time coming from the same wallet. You know, like a monthly fee for a VPN. The first month you're one of a thousand people. The second month. Maybe you're one of 500. Eventually they get you.
But I know nothing about XMR, they probably solved for this. I just can't be bothered to read :-D