It would standout but then what can you do? Find the private key for that new address somewhere? You could watch where it paid out to but the user could create a few thousand new addresses and spread it all out so you wouldn’t know which addresses were his and which addresses were payment.
