Here's the difference between you and your God: you know the answer mid August.
You're wrong here.
First, you can do two things with TOR (and not necessarily both):
* hide where the server is
* hide where the client is (already possible in current state of MPEX)
The recent attack was exploiting a website and inserting malicious JavaScript to reveal user's identities.
If there is a security hole in MPEX, you'll more serious issues anyway, but the JavaScript issue would likely not arrive as I'm pretty sure most MPEX clients are not regular browsers.
TOR itself was not compromised.
Is it useful to hide where the MPEX is? Certainly not now. But what happened lately is irrelevant.
The one thing you can do with TOR is not get involved with it.
At issue is not the ease with which US Terrorism installed an exploit on stolen property, at issue is the ease with which US Terrorism stole the property in the first place.
, for that matter: free for a song.