It's trivial to use iptables to block all traffic except to the SOCKS proxy port on Tor, or even forcibly redirect it all through Tor directly using the transparent proxying support.

You can do all that on a host PC as well. I still don't see what additional layer of security Raspberry Pi adds here. Or am I missing something?

The idea is that even if the host PC is pwned the Pi will still route the traffic from it via Tor.

If the host PC is pwned then it can still disclose useful information about itself (files, Geo locations, mac addresses) - it will just be routed over TOR.

True. So it must not contain anything that's associated with you, in any way. Buy with cash. No geolocation data. Dedicated LAN. No sneaker net sharing. Compartmentalization.

Totally agreed. I nearly edited my comment yesterday to include this actually.

It is just one potential brick in your security wall.

Indeed. People are wrong with such confidence these days.

Yes, that's a serious problem. But being wrong in parent's direction isn't so bad ;) Over-engineering and prudence is my mantra.