Law enforcement have for decades been anonymous, wearing plain clothes & hiding behind false identities in efforts to catch criminals. Tor just gives them digital plain clothes. If they were going through an open HTTP proxy, that box better have a decently network facing attack surface (unlikely). Sure, it's the same deal with Tor, except you have to pwn about 2/3rd of the network (4000+ boxes) before you know about the equivalent of pwning 1 sole proxy. Keep in mind there is a good mix of software, a whole variety of kernels etc.

If you have one of the less common architectures around, consider running a Tor node on it :-) Then we get a mix against random machine-code backdoors too.