Recently, I saw someone treat "on-chain privacy" as an invisibility cloak.

Actually, I think ordinary users shouldn't have too high expectations: on-chain is an open ledger, in simple terms, you're just replacing your name with a string of addresses.
If someone wants to track you down, it's not hard to link them together.
The compliance side is also quite realistic; platforms/projects will cooperate when they need to.
What you can do more is to leave fewer clues, avoid reckless authorization, and don't treat your main wallet as a social account to show off everywhere.

If I hadn't taken the shortcut of using the same address to claim airdrops, buy NFTs, and transfer to friends,
later on, it wouldn't be so easy for someone to analyze a string of transactions and figure everything out clearly...
By the way, there's been a lot of fuss lately about NFT royalties.
I understand creators want to earn income, but when secondary market liquidity tightens, everyone prefers to take "a bit more gray" routes.
In the end, the tug-of-war between privacy and compliance will only become more awkward.
Anyway, I now have one principle: don't expect absolute anonymity, and don't challenge risks you can't bear.