The common misconception is that you have to run the nodes to do a traffic correlation attack. It's enough to see the traffic of the nodes e.g. on a IXP or as the ISP. [0] Even if the VPN is trustworthy and adversary that is able to break Tor could most likely still sees the traffic and can do a similar attack like he did for Tor.

I'm not saying that this happened only that if you think that there is a global adversary that can break the Tor anonymity a VPN won't protect you.

[0] https://www.ohmygodel.com/publications/usersrouted-ccs13.pdf