Do you have more information about how susceptible CoinJoin is, because what I've seen for someone that knows what they are doing it would be near impossible, especially if they then convert it to Monero after.

Here's a chainalysis blog post where they say they tracked coins through CoinJoin: https://blog.chainalysis.com/reports/plustoken-scam-bitcoin-...

If they convert to Monero after then it's a different thing entirely.