They had a security audit, they have a canary on their website, they have a privacy policy which is legally binding, and they have a business incentive.
If you so much suspect that they do collect searches and associate them with accounts (something which they claim they don't do), you can make a report to the relevant data protection authority, which then can audit them.
As someone else also commented, you can use an alias email and pay in crypto if you really wish to not associate your account with your searches. Just be advised that between IP addresses and browser fingerprinting it might always be possible to associate your searches together (even if not to you as an individual with name and surname), and this is something that big CDNs like cloudflare or imperva also provide for you. So you still rely in most cases on what the company says and what their business model is to determine whether you trust them or not.
So far kagi has both a good policy (great policy actually) and a business model that doesn't suggest any interest for them to illegally collect data to sell them.