If you are a bad actor, you can run a Tor exit node and do whatever you like with other people's traffic passing by. This is similar to what you could do if you

If you are a bad actor, you can run a Tor exit node and do whatever you like with other people's traffic passing by. This is similar to what you could do if you hosted a public wifi hotspot. While ISPs are in power to do such evils to their customers, it wouldn't be a sustainable business model to for example fish for credentials in their customer traffic. For an exit node administrator, this is entirely possible. Tor project monitors for bad exit nodes, but traffic eavesdropping for example is something they can't detect.