This kind of attack on blind signing is indeed possible and usually called a tagging attack. In order to address it clients should verify that a consistent signing key is used.
The simplest way to address this is to require that the input ownership proofs commit to this key, and to broadcast these proofs to all clients who verify them before submitting an unblinded signature. None of the implementations do this.
Using Tor (or something similar) it's possible to mitigate: obtain the key and the blind signature using separate requests with connection isolation, and ensure that they are unlinkable. In this case a corrupt server would have to correctly partition the requests which is difficult but it's hard to reason about the difficulty of doing a targetted attack.
In the Schnorr blind signature based version of Wasabi 1.x the round keys (one per denomination) are fetched and are not compared to those obtained in any previous responses before requesting a blind signature. Note that for this mitigation the fact that the blind signature requests are inherently linkable to a specific previous status request due to the way the R points are handled is not a problem, the key point is that the client only reveals the input after obtaining the server key.
In Whirlpool the public key is part of the response to input registration, so there is no opportunity for such mitigation.