Potential exploit: one large donor who donates through a large number of proxy supporters.

This is called a Sybil attack and Sybil resistance is a known and highly discussed aspect of Quadratic Funding. There's lots of projects tackling this like https://passport.human.tech/

Yeah I'm not sure how they address it with privacy coins.