I don't think there is anything magic about three hops. You need at least two so that no single node knows both the source and destination. With a third node you are able to isolate the first and last hop from each other to make it more difficult for collusion, but needing a third hop is probably outside the threat model for most people. With Tor what is usually more important is making sure the nodes span different providers and jurisdictions.