That is factually incorrect.

Help page from Kagi (I'd understand if you don't trust it), fit for non-techie consumption. https://help.kagi.com/kagi/privacy/how-does-privacy-pass-work.html

So here's the RFC, which defined the protocol in the first place (Kagi didn't invent it, just implements it) https://www.rfc-editor.org/info/rfc9576/

As such they have absolutely no way of 'deciding' to look up a searchers account based on the token used.

That ofcourse does not reduce other ways anyone can track you like fingerprinting.