Running a hosting service is sure to include far more exploitable surface area than the tor network itself.

Just assume any one of their servers were vulnerable to RCE attacks, they hosted dynamic web sites on conventional web hosting stacks! These things leak deanonymizing information like a sieve.