Could they not purchase some “Freedom hosting” and upload a website with backdoor?

This seems like the easiest way to do it, so I would speculate that this is how it was done. All you have to do is put a website up and make the server phone home, revealing the hidden IP address. Some more speculation: the government is hiding this fact in order to deter criminal use of Tor.

Of course, I would still assume that other ways of discovering the location of hidden services have been found. I'm not convinced that onions can be hidden from an adversary with the resources of a US government agency, particularly in light of some of the posts that appeared on Hacker Factor recently.

How would they FBI know to purchase "Freedom hosting"?

I have searched and reread the article to find this "explicit mention" and have come up empty. Can you be more specific?

Ctrl+F Firefox in the article, there are a few paragraphs on that vulnerability and its role in the article. But that exploit, as I understand it, is not responsible for the first unmasking of Freedom Hosting which is the central question here.

Found it, thanks!