Generating any child key from any parent key involves a one way hash function which cannot be reversed. This is true for all key generation in bitcoin, including generating a single address from a master public key. You cannot go backwards up the chain from a single address or public key, or indeed from many addresses or public keys, and calculate the parent key from which they were derived (unless you have additional information from somewhere else).

Even if I knew a million addresses from your wallet, I couldn't recover your parent public key.

Combining inputs from different addresses together in the same transaction is a strong indicator those addresses are owned by the same entity. In many transactions it is also possible to identify which output is probably the change (unless you actively take steps to obfuscate this information), and so again you can link this address to the same owner as the inputs.

That's not accurate though. There are many ways that people leak all the addresses in their wallet to third parties. The most common is by not running your own node. Any wallet which is not Bitcoin Core or is being pointed at your own node/server must connect to a third party server to query the history of the addresses in the wallet. When you do this, you send all the addresses in your wallet to the server and the server looks them up for you and send backs the balance and relevant history for those address. By doing so, the server can therefore link all the addresses in your wallet together.