While man-in-the-middle attacks may be detectible (http://www.cs.kau.se/philwint/spoiled_onions/techreport.pdf http://www.cs.kau.se/philwint/spoiled_onions/tech

While man-in-the-middle attacks may be detectible (http://www.cs.kau.se/philwint/spoiled_onions/techreport.pdf http://www.cs.kau.se/philwint/spoiled_onions/techreport.pdf) just recording all the unencrypted traffic would be worthwhile. The simple answer is most people that use an electronic device -- Tor or otherwise -- have no idea what they are doing. Because Tor is advertised as extremely safe, they think they are safe. Anyone wanting an interesting stream of data just has to operate as many exit nodes as their budget can handle.