PayJoin privacy only works with specific output sizes?
we can postulate a rational coin-holder would never construct a transaction with more inputs than required." 


I don't think this is necessarily true, a user may create transactions with unnecessary inputs in order to confuse such privacy-attacking heuristics. It is in the user's interest to retain some privacy, after all. 

Privacy is complicated, but if payjoin transactions became more common-place, and wallets also created pseudo-payjoin transactions some fraction of the time, then the general idea is that some of the heuristics used to group addresses would become much less effective.