If someone is using Tor, it doesn't mean that they are some l33t cypherpunks, it's likely just people who want to buy drugs online, and use that browser because that's the only way to access .onion sites. They might even have some false sense of security, thinking that they have already achieved full anonymity and there's nothing to worry about. This is a lot like people who install fake Bitcoin wallets - the reason why it happens is because most of the population doesn't know that you can and should verify digital signatures of developers, and when Windows warns them that they are about to install a software with unverified publisher, they mindlessly click ok, because they are used to pirate software or installing some junk.
As far as I know, TOR is used
not only for illegal purpose such as purchasing drugs, guns, etc. There are many interesting forums in the Darknet, so people can communicate with each other without
censorship. Moreover, Satoshi Nakamoto who created Bitcoin has always posted messages here using the TOR network.
TorBrowser must be downloaded
only from the official site. The EXE file is signed by an organization called "The Tor Project, Inc.". In this case, no one will be able to steal bitcoins through the installed "trojanized" TOR.