I don't see it as having two points of failure. You're just shifting it, from Mullvad to Obscura.
Maybe I'm wrong, but I thought in this scenario obscura has your IP, but not the web traffic/public IP. Mullvad knows web traffic/public IP, but not yours. Neither knows both so neither can individually link an individual to their web traffic.
1