A structural MRI is identifiable. A surface reconstruction of a face can be matched to a photograph well enough that treating T1 scans as anonymous is not defensible, which is why defacing — removing or distorting facial features while preserving brain tissue — is a precondition for sharing structural data rather than an optional courtesy.
The less obvious risk is metadata. DICOM headers carry patient names, birth dates, institution names, accession numbers, and referring physician fields; some vendors write identifiers into private tags that generic anonymizers miss. Conversion to BIDS drops most of this, but BIDS sidecar JSONs inherit selected fields, and acquisition dates can persist and be enough to re-identify someone in combination with other records. Participant lists are their own hazard: a spreadsheet mapping study IDs to names, stored beside the data because it was convenient, is the most common failure in practice.
Defacing is also not free. It can disturb registration and segmentation, so it belongs early in the pipeline where its effects can be checked, not bolted on at sharing time.