In the situation you're describing, there's a level of complexity. When we're talking about the incognito mode, we are not collecting information about your searches. We're not collecting information about your behaviour in using the browser.
If you're, in fact, talking about behaviour that could be damaging or illegal or seditious, you're likely engaging in other activities that would then signal or send a flag, or be noticeable through other forms of communication and transmission online. Those would be more traditional log analyses, the sort of materials we use and every company and every government uses to identify illegal behaviour. But incognito mode itself, you're right, is a very secure tool that offers a confidence to the user.