My understanding is that the real risk is taken by the buyer. The seller can anonymously receive payment, then drop the drug envelope into a random postbox. On the buying end, regardless of Tor and Bitcoin, they still need to have it shipped to a real physical location.