>They wouldn't go through the trouble to identify and blacklist exit nodes and present users with a captcha otherwise.
Do you really think they care about that 1% (made up number) of Tor users using their service legitimately? Or do they just want to avoid being attacked or their service being abused?
The same attitude should be expected from all InfoSek vendors. But it's easier to sell a product with claims it will protect you rather than saying the truth (that it's riddled with edge-cases like everything else).
Tor, unlike many of the VPN companies, thankfully lack a marketing department trying to push it with incorrect claims about its alleged ability.
edit: if the threat model is to protect against corporate mass-surveillance ("the big guys"), then Tor is incredibly effective. They wouldn't go through the trouble to identify and blacklist exit nodes and present users with a captcha otherwise. (ofc assuming that it is used correctly: never log in, or if you must only log-in with sock-puppet identities etc).