As far as I know, TOR is used not only for illegal purpose such as purchasing drugs, guns, etc. There are many interesting forums in the Darknet, so people can communicate with each other without censorship. Moreover, Satoshi Nakamoto who created Bitcoin has always posted messages here using the TOR network.
Yes, but that's not the point, this malware was targeting users of Darknet markets specifically:
According to malware researchers at cybersecurity firm ESET, the trojanized Tor Browser appears to be
specifically targeting users of three of the largest Russian-speaking Darknet markets.
TorBrowser must be downloaded only from the official site. The EXE file is signed by an organization called "The Tor Project, Inc.". In this case, no one will be able to steal bitcoins through the installed "trojanized" TOR.
Regular people don't know anything about digital signatures and verification of software, they just google "download X" and click the top result, or install something because they saw it on their forum or news feed. You either learn from mistakes of others or eventually repeat them yourself.