Everybody knows the security of TOR doesn't only come from the URL you type on your keyboard. This is called exaggeration not being incorrect.

The claim that Tor hidden services use TLS in order to encrypt their communication seems incorrect to me.

I actually imagined they always would since you would use the url to verify the pubkey. Why would they build hidden services without it?

Public-key cryptography is used by Tor hidden services but it's not based on TLS/SSL certificates. There are a lot of detailed explanations of how this works on the web, but if you just want a quick overview I recently wrote about in the introduction of an article for 2600 (summer 2017 issue https://store.2600.com/collections/2010-2015/products/summer...). You can find a copy of my article here: https://pablo.rauzy.name/outreach/2600/how-to-run-a-tor-hidd...