Even if it is not full xpubs, it is addresses and tx ids, which can be associated used to build a usage profile. 

And either of those scenarios is not in itself, exotic. Every piece of shit phone wallet does this. It's just that Samourai markets their piece of shit phone wallet as a "privacy wallet" that is "for the streets". 

Not a privacy wallet.