Tor is vulnerable to adversaries that monitor Tor exit nodes. But this assumes for such adversaries to also control the destination service.
The attack is effective if the adversary is setting up its own fake websites and then luring users in (with child porn, etc.), correlating their traffic. But for hot services, like Gmail, even if the NSA has the potential to track Gmail's traffic, the noise and the false positives are too great.
And for services outside of the US jurisdiction, the NSA isn't able to legally coerce companies into giving them the keys needed for mass surveillance. Sure, they can reach agreements with local intelligence agencies for wiretapping and exchanging of information, but it would be an international disaster if it got out that foreign companies were forced through legal means by an US agency to hand over control. And this extends somewhat even to US-hosted servers of foreign companies. Yes they have physical access to US-based servers, no, it's not necessarily easy for them.
What this means is that the NSA is not able to control and measure many popular Internet services. It's also all a matter of cost. Raise the cost significantly and it will get too expensive to do mass-surveillance, even for the NSA.
Of course, if they target you directly, then all bets are off. Though in such a case they can just wiretap your home and office and hear everything you do or speak. But in the meantime if I use apps like Signal for communications, or PGP for my very private email, or SSL for connecting to my web server, I can be sure that the NSA is not tracking me because I'm not a target, I'm not a US citizen, I'm not interesting and it's probably expensive for them to track me through those channels.