That’s why you move the XMR to your wallet first, and do not send it directly. The crypto exchange doesn’t know anything about where you’re sending the money if you do that.
They can’t see anything about Monero by design. There’s a leaked cia/fbi/? presentation out there of them working to trace Monero for a single purchase, on an older version of the protocol.
Been a sec I used XMR, but getting a secure wallet was simply built into the desktop gui wallet (which is the default recommended option on getmonero.org). While getting that wallet it also tells you to backup the seed phase (preferably by printing it iirc). It has a simple mode especially for non-tech users.
So installing the GUI wallet takes care of 3/4 points, then to fund it you just find any reputable crypto exchange that supports sending Monero in your region (I used kraken before in the eu). By design in Monero the platform (which does have to do KYC probably) doesn’t know anything about where they sent the money. Transactions are not traceable in Monero.
These days the user limit is at 6 users. That could be large enough for a family, though not quite sufficient if you want to share with a whole bunch of friends .