They tried to cover it up by adding onion-routing for friend requests, but ACTUAL MESSAGES are still done directly.
Strong adversaries such as your ISP and agencies like the NSA, the GCHQ, etc. can still collect metadata about your conversations.
The "Tox Foundation" tries to cover this up and pretend that "tox was never meant to be anonymous", but the truth is harsh.
Now, this wouldn't be a problem if the Tox Foundation made this issue clear to its users. This is how P2P works, after all, direct connections, and that's fine.
But the problem is that Tox doesn't make that obvious for non-tech-savvy users.
When they read on the website that they are completely safe from the NSA and whatnot, they won't expect to be in any way exposed.
Still, unless these non-tech-savvy users "route all incoming and outgoing traffic through Tor" they won't be completely safe and should be worried about metadata leakage and adding people they don't actually know. But such a thing isn't made clear and Tox deceives users this way, only to get more people using it. It's unethical and outright wrong, in my personal opinion.
Full disclosure: Tox has not yet been professionally audited.