but not always
I too use Tor for only legal purposes - visiting clearnet sites that are blocked for my country or my ISP, or when I simply want extra privacy for my searches. I can't even remember the last time I visited a .onion domain. And I know there's a ton of other legal/moral uses, like when dissidents use it to not get caught and imprisoned.
But still reports put illegal uses at a very high level, and even if it's not the majority of all uses, it's very likely the biggest group of uses. But regardless of it all, my original point can still be applied - usage of Tor is not a sign of a privacy expert, so it's natural that even Tor users can fall victims to fake clients.