Is there something new here? I’m under the impression that we knew this kind of thing was possible with enough resources.
TOR ultimately works like any old relay system; if you control enough nodes, you can effectively decloak people if they happen to connect to only your nodes. Nodes are assigned for connection based on a trust value so all a Nation state would have to do is host enough nodes (relay+exit) and they'd be able to decloak a connection. This kinda inherently gives TOR decloaking abilities to entities with the most infrastructure, which at that scale basically will only be nation states.
TOR works well enough for privacy when your adversaries aren't well-funded state actors. (ie. It's probably enough to mask your traffic if you use TOR to access resources to get out of an abusive relationship or need to circumvent cult-level inspection of your personal interests by religious schools. Most dictatorships also don't really have the resources to mount this sort of attack - it's probably just the US and some European countries.) That rule kinda also goes for VPNs in general however.
Also, these nodes operated by bad actors are constantly identified and excluded.
Does the tor daemon connect automatically? If so, even people who installed tor for fun and forget about may be on the list.
Did the lucky ones have the "Bundestrojaner" (gov surveillance app) installed on their machines?
Good. That reduces the quality of the list.
There probably is a dragnet too.
Most people don't need anonymity most of the time...
That's sufficient motivation right there.
The problem is that once you have the infrastructure you can go after, well, any other random Tor onion service you damn well please, all with a minimum of judical oversight (if any).