A privacy rail still has to prove its own supply.
The Zcash Orchard bug is a useful reminder that confidential balances and an auditable monetary system are two different requirements.
In payments and regulated financial systems, privacy is never the whole job. You also have to prove the system did not create value it was never supposed to create. A bug in Orchard's shielded pool could have allowed counterfeit ZEC to be minted with no on-chain trace, and the same privacy properties that protect users could also have hidden the failure mode. There is no evidence it was exploited. That is not the point. The point is that for a while, no one could prove it either way.
That is why the proposed Ironwood upgrade matters. It keeps the privacy and adds a turnstile that makes total supply independently verifiable again, so confidentiality and auditability stop being in conflict.
This is the hard part of financial infrastructure. Confidentiality, compliance, recoverability, and integrity all have to hold at the same time.
A private ledger that cannot prove its own supply is not just private. It is unfalsifiable, and unfalsifiable is hard to trust.