I run a service that scans and documents hidden services. I've actively contributed to the security of the Tor ecosystem by reporting vulnerabilities that would

I run a service that scans and documents hidden services. I've actively contributed to the security of the Tor ecosystem by reporting vulnerabilities that would result in de-anonymization. I can say with pretty good authority that most hidden services are deserving of the 'shadowy' label. I agree that the only way to change this is to have other non-shadowy services and uses, but it's a hard sell. How do you convince a company to intentionally stand up an onion site that provides any real value? You lose the ability to apply some defensive controls to thwart attack, you're associating your brand with something identified as 'shadowy', and most customers won't use Tor or even understand what an onion site is. If a company is unwilling to justify the effort or take the chance on standing up a hidden service, why would they be willing to take a similar risk of abuse by allowing traffic sourced from the Tor network?