I've seen compromised iot devices used to run proxy servers. They are mostly resold on black market as residential IPs for web scrapping and such. Since there is a black market for it they mostly get resold, instead of put to use on the free TOR network I guess.

Residential ISPs usually monitor the blacklisting of their IP addresses and will contact/suspend the customer once the IPs get listed on public black lists.