The attack surface matters. If the only exposed services are tor and sshd with public key authentication, one would need a vulnerability in either to compromise

The attack surface matters. If the only exposed services are tor and sshd with public key authentication, one would need a vulnerability in either to compromise the host. How long ago was the last RCE on pre-authentication sshd? (Of course, the lack of patches means that, once someone gets a RCE on either of these daemons, it's probably game over for the host.)