In modern society everything gather meta data. The phone, the credit card, the mass transit system, cameras with face recognition, the isp, all the routers between A and B, the devices people own, the platforms they socialize on. Its almost impossible to make a face to face meeting without allowing nation agencies to know about it. A leaker wanting to talk to a journalist without risking becoming a target might not be 100% protected by tor, but then I don't know any single better method right now. Some combination of obfuscation, encryption, mixing, and plausible deniability seems to be the best bet.

Go on.

As far as you know.

The same attitude should be expected from all InfoSek vendors. But it's easier to sell a product with claims it will protect you rather than saying the truth (that it's riddled with edge-cases like everything else).

Tor, unlike many of the VPN companies, thankfully lack a marketing department trying to push it with incorrect claims about its alleged ability.

edit: if the threat model is to protect against corporate mass-surveillance ("the big guys"), then Tor is incredibly effective. They wouldn't go through the trouble to identify and blacklist exit nodes and present users with a captcha otherwise. (ofc assuming that it is used correctly: never log in, or if you must only log-in with sock-puppet identities etc).

Do you really think they care about that 1% (made up number) of Tor users using their service legitimately? Or do they just want to avoid being attacked or their service being abused?