Yes Opsec is hard, but not in this specific example: one would just setup a VM with tails [0], and one would only performs its shady actions within this VM, and all one's outgoing network activity would automatically jump threw a TOR exit point, and why not a VPN tunnel above it. No chance (well, almost no chance) to screw here.

Doing something shady from a regular workstation is either a mark of noobiness, or it's someone trying to disguise as someone else. Relying on manually launching a commercial VPN each time when you want anonymity? It's not really opsec per se.

[0] https://tails.boum.org