Tumblers are trusted and are commonly not providing sufficient protection to hide links from a state-level actor. Practically nobody who knows what they're doing would be using a typical tumbler service, for multiple reasons. The field has moved significantly since they would be used for something like this.