Yes, if you can observe incoming and outgoing traffic you can trivially use timing attacks. That being said, If you have that capability, mullvad isn't going to

Yes, if you can observe incoming and outgoing traffic you can trivially use timing attacks. That being said, If you have that capability, mullvad isn't going to keep you save anyway. As the folks over at PerfectPrivacy succinctly put it: If you have a whole NSA Team after you it's game over anyway.