> But what about when no exit nodes are involved, when you connect to hidden services?

OP is claiming that a combination of traffic/volume analysis and dishonest nodes can find a hidden service source.