The paper does not state what you make it out to be (it sees theoretical privacy-lowering attacks, but not as you state it "lack of privacy"). Practical attacks are not even proven.

And it - too - does not look into trampoline payments. Trampoline payments are a new feature that are not yet in a BOLT standard, but tried and tested in beta and used i.e. by Phoenix Wallet or Electrum.

It isn't just "theoretical", those are feasible attack vectors.

Anyways thank you for mentioning Trampoline payments, I've learned something new.