It's becoming more important to think about metadata attacks. 

With Bolt12 and FCMP in Monero, privacy on-chain or within LN gets better and better. But if they are operated with security and privacy holes like all MacOS, Windows, Android  devices all sorts of metadata will still be gathered and AI will do the correlation.

The bad thing here is that you can not know your trade partners setup.

Is he using Haveno on a Windows machine?

There are now so many things to consider.

As hyperinflating countries prove. Cash is still better. Find someone you trust to go from cash to digital cash and back. Depending on the status of hyperrinflation in your country, once a month, once a week should work well. You'll still leave some metadata, but less that could be easily correlated to a money transaction.