PayJoin privacy only works with specific output sizes?

Question

In the specific example of PayJoin here: https://en.bitcoin.it/wiki/PayJoin the wiki equates a PayJoin transaction as indistinguishable from a regular transaction.

However the transaction example itself seems a little weird and potentially misleading. In a regular transaction, if I have a UTXO of 2 btc and another UTXO of 5 btc, an attempt to send that results in an output of either 3 or 4 btc would be best served by using the 5 btc input only, as this would create a smaller transaction than needlessly using inputs of 2 and 5 btc (it would also needlessly link two addresses); we can postulate a rational coin-holder would never construct a transaction with more inputs than required.

So it would seem that to make a PayJoin transaction genuinely indistinguishable from a regular transaction, one of the PayJoin outputs must be larger than any single input. If in the example the merchant and customer wished to exchange 5 btc, then outputs of 6 btc and 1 btc could be created, which would absolutely justify combining a 5 btc and another input of at least 1 btc.

Am I correct, or have I made some oversight?

Answer 1

we can postulate a rational coin-holder would never construct a transaction with more inputs than required."

I don't think this is necessarily true, a user may create transactions with unnecessary inputs in order to confuse such privacy-attacking heuristics. It is in the user's interest to retain some privacy, after all.

Privacy is complicated, but if payjoin transactions became more common-place, and wallets also created pseudo-payjoin transactions some fraction of the time, then the general idea is that some of the heuristics used to group addresses would become much less effective.