They could create a million nodes, it would make no difference. You are wasting your own time with these questions.
why? i thought changes on the protocoll are voted by full nodes? am i wrong?
I made a thread about something similar a couple years back. Somebody popped up a lot of (clearnet) nodes. At the time I was thinking that they're either trying to do a connection-exhaust attack or partitioning attack. I'm having trouble finding it right now. In practice, it usually creates a high cost for the attacker with very little to no gain.
what is a connection-exhaust attack or a partitioning attack?
tl;dr;
why are there now 2000 instead of 200 full nodes behind TOR after just one weekIt's not likely to be an 'attack' , unless they also started mining above 51% network hash rate - collectively.
Basically, very improbable if not impossible.
Maybe a GeoIP update dropped some country ranges from it's database ? Hence, n/a . ? ...Oh snap! Hehe, currently 2225 .onion's ...
-
https://bitnodes.earn.com/nodes/?q=unknown-countryAlso, it's not TOR - it's Tor.

P.S. Monitoring the number of connections (only) on my own dedicated Tor nodes - nothing to unusual to report - yet!
EDIT:
Wasabi Sauce ? -
"A Versatile Condiment With A Velvety Zing"-
https://en.wikipedia.org/wiki/WasabiSushi_Wasabi ...
-
https://youtu.be/wbNLtttn8eU-
https://www.wasabiwallet.io/-
https://docs.wasabiwallet.io/why-wasabi/BitcoinPrivacy.html#network-snooping 