I run one of the bigger Tor relay families [0] with around 3.5% of the exit bandwidth [1]. Hosting high bw stuff is actually pretty cheap if you stay away from the cloud. I don't pay five figures per month for all these relays it's less than 1k$. For the actual question there was a big attacker uncovered in 2021 [2] and removed from the network. I'm pretty sure there are still malicious relays on the network the hard part is to know which.

[0] https://metrics.torproject.org/rs.html#search/family:C466C9A...

[1] https://nusenu.github.io/OrNetStats/#exit-families (tuxli.org)

[2] https://nusenu.medium.com/is-kax17-performing-de-anonymizati...