Large-scale traffic analysis (dragnet surveillance) + hacking into exit nodes already made compromising TOR users technically feasible before the heartbleed exploit.

The whole cypherpunk/online anonymity movement which spawned TOR was largely predicated on nation states acting legally. But when they can secretly hack into every router, fiber cable, and gateway endpoint without any question of legality then anonymity and privacy online is no longer an option for anyone, even the most technically-proficient.