Every so called "leak" there is a non issue except for the 16 output ring signatures. This is less of an issue now as KYC exchanges are more and more delisting Monero, but still a rare deanonymization vector. After FCMP++ upgrade (already in stressnet) this attack vector becomes impossible and Monero has mathematically perfect on-chain privacy.

Saying that giving two people the same address is a "leak" is retarded. Its basic opsec that if you're trying not to link identities, you can't give both recipients the same information. This is why you can make subaddresses. This doesn't mean something like SimpleX chat, or Signal has a privacy leak if you give your same username or chat link to two people and expect them not to compare notes.

Recieving privacy in Monero is the greatest strength, and is better than any existing payment system, especially lightning which requires leaking your public key. There are some ways around this I hear but generally this is the major weakness.

Also your LN peer node knows every transaction going to you, both in amount and what node it came from. If it's a one hope payment, then one entity knows everything. If it's two or more, then nodes just compare notes (timing analysis) and the whole transaction is deanonymized.