They say they get around the easy linking of a single wallet address to your identity by using subaddresses. I don’t think this fixes it, it merely delays it.
The number of these subaddresses are capped to prevent botting. But suppose you use this account every day for years or decades. You’ve meticulously allocated subaddresses for different categories of spending, assessed the risk profile of using each one, and used them throughout the years until you’re out of subaddresses.
Now you’re vulnerable to having your identity tied to the account since the risk of getting had goes up every time you use any of your subaccounts. And this risk only increases the more you use your Worldcoin.
Even if the biometric privacy safeguards they built in (hashing yer Mk. I orbs) work perfectly, I wouldn’t use it for the reasons I mentioned above, there isn’t a way to ensure transactional anonymity if your account/subaccounts can be linked to your real identity regardless of the method.