Why not? It would just mean that the NSA needs to own more routers than it would to break TOR->Public internet routing.

From what I understand, connecting to an onion address 'just' involves 6 routers, not the typical 3. (Of course an oversimplification.)

Or am I misunderstanding your threat model here?

>A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers.

Sounds like a 51% attack on crypto blockchains.

Yes, but this doesn't require 51%, at least as users typically use Tor.