Yes, but purely on-chain leakage is also possible.
One simple example: it’s likely your ZEC wallet balance is a round number minus a small multiple of the standard tx fees.
I send 0.00269412 ZEC to your (public) Sapling address.
When you migrate, I find the two migration txs which sum to a round number minus a small multiple of the standard tx fees plus 0.00269412 ZEC.
Now I know your account balance.
Another example: I saw the shielding transaction you used to fund your Sapling zaddr (after, say, you bought ZEC on Coinbase and withdrew it to your taddr). Later, I see two migration txs that sum to exactly that, minus 0.3527 ZEC. Which happens to be the membership dues of the Caribou Hugging Club. You’re outed.
Far-fetched? Perhaps. But remember, this is on-chain, so there is all the time in the world for people to come up with new algorithms and heuristics, as well as dig up new data to correlate against.