The moral of the story is almost always that it's not Tor but how people use it and the small (or very large) mistakes they make where their activity can be correlated with identifying information.

Almost every tor user who gets caught doing bad shit screwed something up. The problem is it's very easy to use tor badly and screw up. Tor isn't a magic trick where suddenly you're anonymous and you can do anything. Tor is one major step to anonymity, and you have to be aware of a whole lot more than just using it.

Every time I've heard of a tor user getting caught, it's because of a mistake they made, not a flaw in Tor. There might be tricks to make it easier to correlate traffic, but that's not what they're doing. They're tracking people down because they're correlating their activity through other means, either data they leaked on accident, something they say, correlations with other activity they did on that site off of tor, running javascript and getting their browser exploited or fingerprinted in a way that leaks enough information to correlate with other non-tor usage by that user... there's a million ways to screw up and you only need to screw up once.

But seriously, Tor is pretty damn good at what it does and I agree that people should be skeptical of their anonymity when using Tor, but not because Tor is flawed. It's because they have to be close to perfect if their adversary is law enforcement. If their adversary is some arbitrary business, then that business is mostly screwed when they see the person that attacked them was using tor. If it's the FBI tracking a specific person who uses tor, that person has to do it perfectly or they're screwed.

Yes, there are malicious exit nodes. There are malicious nodes on the network. Yes, the exit nodes can see unencrypted information leaving Tor. Yes, the government likely has a lot of nodes, but not enough to have a practical way to deanonymize any arbitrary Tor user. Yes, the government even funded the creation of Tor. But none of that really matters if you know what you're doing. If you take proper precautions and use Tor properly (which is no small task and this pretty much takes an expert), then you are pretty damn anonymous with Tor.