Let's game this out. Bob and Alice are the first parties.
You trade in cash, in person, probably in a public place. Say that Alice then gets in trouble for the drug dealing they also do (or maybe the government just pings her for not doing KYC and being licensed to do financial transactions), it could be years later. The authorities seize Alice's computers and subpoena "localbitcoins", or the whatsapp/telegram/signal chat that you had to organise the meetup. They might even have a list of addresses that Alice used for transactions at this point. Alice may or may not have had good OpSec, Bob doesn't know.
From that there a myrriad options to identify Bob and Bob's addresses.
In your example you don't use an exchange, but that's not the only method of identifying Bob. Mass survelliance and metadata gathering noticed 100 phones within the location and timeframe Bob and Alice were supposed to meet. Bob had to take a phone to do the actual transfer of bitcoin (or any altcoin), so just leaving it at home wouldn't work. They also know the amount Alice transferred to Bob and the rough timeframe that it was completed and put into the ledger. Bob was also seen drawing out roughly the right amount from the ATM an hour before the meeting. Of the 100 phones, most haven't drawn out that much money recently.
So they can correlate a set of phones with a set of addresses. Even if Bob is not completely unmasked at this point. He has the money in but has to get the money out as well. Bob wanted as you say, to move money across the border. In order to do that Bob must cross the border[0] and meet with Charlie to do the reverse of the transfer. Only a handful of those 100 phones crossed borders shortly after meeting with Alice.
As soon as the money in that address moves again the cross reference with the locations of the tagged phones and discover that they know Charlie because he's done a KYC with an exchange and installed their app (even if he doesn't use that address for the transaction). They ask Charlie some pointed questions about whether he is following KYC procedures in his financial dealing and he caves and gives up the chat logs confirming your meeting, or maybe they just install NSO spyware on his phone and watch to find all the other people Charlie is dealing with.
So...
In a perfectly isolated one off instance maybe that's pseudonymous. In any real world transaction it's extremely unlikely that a state can't use it's resources to unmask the participants. In a one shot, the rules might be one way, but in multi-shot there are always factors that will serve to unmask the participants, and in reality you have to do those transactions over and over until you slip up and just combine them with a KYC exchange account and it doesn't even require that level of effort on the part of the state. OpSec is hard, as they say.
[0]: there is an alternative where only the bitcoin transaction crosses the border in return for something of value, either physical or digital, both have alternative paths that can be tracked in similar ways.