Hello,
So I use Mullvad VPN (and Mullvad browser).
My entry node is the nearest server in a neighbouring country, and between me and there DAITA and quantum resistance is enabled.
My exit node, because I use multihop, is set to a server in my home country so I get served sites in my local language.
Is this a really bad setup for privacy or would it still be difficult to connect traffic coming in and out of the exit node with me?
Yes, that’s bad: your government tracks the entire chain of connections.
What do you want to protect against? What is your threat model?
For privacy against the ISP (end service privacy) and the end services (IP address), it works fine.
The problem might be that the government can monitor your origin traffic (to the neighboring country) AND the exit traffic (from the exit VPN server), and they may be able to correlate your traffic. Origin/exit traffic correlation is also a problem with the Tor network, but the correlation is done on a more limited basis, depending on resources and ability to place traffic observation points.
TLD;R: if your threat model is the government targeting you specifically, the setup you mention may not be enough. If you just want casual IP address privacy from the end services, and privacy from the ISP, using a single-hop VPN is likely enough.
Not an issue.
If someone was surveilling your traffic, they would need to monitor both VPN servers anyway, so it would require a lot of effort and co-ordination. Especially with Mullvad, they run everything in RAM and don’t keep logs.
If your threat model is actually so high that you are concerned about that being a possibility I would suggest using Tor.
Could you share some more details about what in particular you are worried about?