Coinjoin exists you know.
therefore it inherits all its security issues
That does not follow (and is not true except when closing channels)
Lightning is vulnerable to several types of correlation attacks currently though, if an attacker controls multiple nodes along your route. These are partially addressed in BOLT-12 (which is not yet production ready), not sure if/how they can mitigate timing attacks.