But neither the addresses nor the people who had them where. It would be like saying that you can identify someone from an arp table because you can see the mac addresses.

Unless you know specifically who own said address (even to the point that those can be spoofed) you just have a big pile of wet paper.

Bitcoin was designed with the theory that the ledger would be public, but that various techniques would make it very hard to get anything useful out of that ledger other than the fact that a payment went through. These included change addresses so a single payment resulted in 2 transactions to 2 random-seeming addresses. This is described as a "key privacy feature of bitcoin". But, if you can identify which addresses are change addresses and which aren't, that privacy is compromised. That's one of the techniques she developed.

Bitcoin transactions having multiple inputs and multiple outputs was also supposed to be a privacy feature, but it had the drawback of making it easier to cluster addresses as being related.

Basically, the bitcoin devs / early bitcoin enthusiasts thought that despite having a public ledger, they could use security by obscurity as a privacy measure, but Sarah Meiklejohn figured out ways of unraveling that process so it was much easier to trace transactions and the owners of wallets.