When the Wallet is started, it is not yet TOR protected by default, I guess? I would need to run it over a local TOR instance (Settings, Options, Network)? Or am I already secure by opening the wallet?
You already secure by opening the wallet and it's a network level security. DeepOnion Wallet is natively integrated with the TOR network and always starts with TOR network. See below the comparison.
Well but a coin running through TOR is definitely worse than a coin like ZCASH in terms of anonymity.
These are two completely different things. I don't think you understand what TOR and Zcash mean.
TOR is a network level security, it hides your IP address, so people can not locate you while you have your wallet client connected to the network. Your transactions can still be traced on the blockchain with your wallet addresses.
Zcash hides the trace on the blockchain. Your coins on the wallet can be generated from completely unknown addresses so no one can link them to your wallet address. But the connection to the network is not protected, your peers will see your IP address.
DeepOnion is planning something called DeepSend which is to hide the traces of the transaction in the blockchain, it is some sort of mixing service with the wallet I guess which will further enhance the security of DeepOnion.