(Carl from Obscura here)

Very true, but if even 1 of (Obscura, Mullvad) is honest, there's no de-anonymization.

For traditional Single-Party VPNs, you just need to compromise 1 party, with Two-Party Relays, you need to compromise both.

They don't even need to. If you observe enough of them you can correlate traffic patterns between them and find out which one is used by which endpoint