But if you run entrance nodes on your intranet, then they have to compromise your endpoint right? But if they compromise that then they don't need to correlate

But if you run entrance nodes on your intranet, then they have to compromise your endpoint right? But if they compromise that then they don't need to correlate with timing attacks, do they?