I mean the NSA might be able to unmask people willy nilly with Tor. We’ll likely never know definitively. but LEA and other governmental organizations have to rely on browser and operating system exploits to unmask people. Which is why you don’t use Windows, enable JavaScript, etc.