https://github.com/monero-project/monero/wiki/URI-Formatting

Both are bad for privacy, but B is especially horrendous. Every time you consolidate transaction outputs like this, you are yelling at the people you received money from: “HELLO! REMEMBER WHEN YOU SENT ME MONEY? I AM CONSOLIDATING THAT IN THIS TRANSACTION RIGHT NOW”. When that transaction is the SAME transaction to actually spend those funds to someone else (AKA scenario B), you lose almost all plausible deniability about the origin of the funds. For the love of everything holy, PLEASE do not “churn” like this. I don’t mean to sound harsh, but since you do not know anything about coin control yet, I would recommend staying away from churning and consolidations at the moment. The most private way to send money to someone is NOT to consolidate ever. Sweep each output to them individually, one at a time, in separate transactions over multiple hours with random timings. However, if you insist on consolidating everything into one output before sending it to them, there’s a couple rules to live by: A) NEVER consolidate outputs AND spend them in the same transaction (i.e. only ever consolidate to an output address that you own), B) never consolidate more than 2 outputs at a time, C) use random delays when churning, D) if you are trying to keep different receiver identities (subaddresses) unlinked from one another, don’t consolidate outputs from those different identities in the same transaction E) once everything is in one output, do at least one extra 1-input tx churn to yourself before spending (after a random delay of course).

This type of tracing is only possible because it appears the attacker was using a Monerujo wallet with the PocketChange feature enabled, and the input selection algorithm with PocketChange enabled is so horribly busted that at every single step of the withdraw/churn, each tx had at least half a dozen rings with input members from the same originating transaction. Most transactions on-chain do NOT look like this.