If only the sender and receiver can connect it with on-chain activity, what's to prevent dust attacks?
No addressing scheme can prevent those. Has to be handled client-side to ignore dust and allow strong coin control.