Does Orchid somehow prevent malicious exit nodes from inspecting/manipulating traffic? (requiring traffic be encrypted?)

I'd consider that to be worse than the risk of a semi-trustworthy VPN provider keeping logs, depending on your threat model.