I'm trying to understand how bitcoin works in more depth. Can someone help me understand why wasabi wallet users should not co-spend change outputs with mixed coins?
I think there's a privacy implication but is there more to it, and how does this work?
When a third party is looking at the blockchain record, they can apply certain heuristics to what they see, in order to try to discern who owns certain coins.
A wallet like wasabi works to break some of those heuristics, essentially leading these blockchain spies to a dead end. If you own an output from a wasabi-style coinjoin transaction, and then spend that output somewhere that reveals your identity to your counterparty (eg, you buy something from an online shop and have it shipped to your address), then the parties that you revealed your identity to will most likely be unable to discern any of your financial history, pre-coinjoin.
This works in the other direction as well: if someone knows you own an output, and then you use that output as input to a coinjoin transaction, then it will be unclear which coinjoin output you own, once the transaction is complete.
So to answer your question:
One of the heuristics is called the 'common input ownership heuristic', and it basically assumes that any inputs to a transaction will all come from the same wallet. Of course, this heuristic is NOT always correct, but in practice it may work well enough to damage your privacy if you are not careful.
So if you spend some coinjoin outputs (which have a history that is hard for a third party to discern) in the same transaction that you spend some change outputs (which may be known to be owned by you), then a chain spy may assume that you also own the coinjoin output! And thus your privacy (as well as the privacy of others in the mix) will be degraded.
