You're 100% right both are at odds. The longer you wait the more you expose yourself to rug pulls. But if privacy and anonymity is your goal it's better to wait. Good question. I think the only thing a mint knows is if a token is valid (or not) and all ip addresses that interact with it, but not necessarily what specific tokens your ip address is associated with since token creation is blinded if I understand correctly. This FAQ has a lot of our questions in it:

Frequently Asked Questions (FAQs) - Cashu.space

Frequently asked questions