The tool performed as designed. This took a months-long international investigation using social engineering and monitoring of hundreds of nodes to to identify four users that were being specifically targeted. It wasn't some novel attack, it's literally something that has always been possible with enough resources.

Ergo, users: don't warrant the resources. Your threat model should not be the same as CSAM site operators.

Also, you misspelled asinine.

Most attacks on Tor are through social engineering. Think DPR. Error occurs between keyboard and chair.

Tor can't protect you from terrible opsec.