Its designed so that a snooping exit node can't identify you, but it can see all traffic.

Which is why you should generally only use https when using tor. The last leg may be snooped on so you need to use encryption during it. (http is fine with hidden services though)

Its important to keep in mind that anonoyminity and data integrity are separate properties. You can have one without the others.

Hmm, just trying to make sure then. If they can see all traffic would using a tool hide this in combination with Tor help?

Using https would help. If you totally disable http (or only use http on .onion sites) the described attack won't work. Similarly, if the site in question enabled HSTS the attack would be prevented.

Think of tor like the open wifi network of dubious origin at a black hat hacker convention. You are probably fine if using https, but plain http is a bad idea.

Using a vpn is more questionable. Generally a paid vpn already knows who you are so hiding you origin ip with tor would be pointless. Also sometimes combining vpn technologies can cause traffic congestion algorithms to interact poorly and make things really slow, but that will depend on which technologies are in use.

My colleagues and I made a chart about this issue when I was working at EFF:

https://www.eff.org/pages/tor-and-https

Designed by the US Navy to ensure anonymity of US agents abroad from other countries via the DoD-birthed Internet, sure.

DARPA's also brought us the Total Information Awareness project. Those project ran concurrently and they had diametrically opposed goals.

But it doesn't mean much as DARPA's seems to fund a lots of projects with seemingly opposite goals.