It seems like providing a tor service to forward traffic after a delay would help disrupt traffic analysis, too.

I thought that was the case as well, however the documentation [0][1] I read indicated otherwise. I didn't do an exhaustive search after reading those, however, so it's possible. If so, I'm surprised. I'd expect the documentation to make it explicitly clear since their are legal and bandwidth implications to acting as a Tor node (though for non exit nodes, the legal ones are small).

Regardless, even if the hidden service is a node itself, a passive observer can still do traffic correlation attacks. It just requires more resources.

[0]https://www.torproject.org/docs/hidden-services.html.en [1]https://www.torproject.org/docs/tor-hidden-service.html.en