Anonymous surfing with Tor - a find for a spy

Some time ago, it was reported that the passwords to the email accounts of some diplomats, and in particular Russian, appeared in the public domain. It seems to be nothing strange - they break everyone. But the way of hacking turned out to be somewhat unexpected for me.
It turns out that a certain Dan Egerstad (Dan Egerstad) installed several servers for the anonymous Tor surfing network, and simply analyzed the traffic between the end servers and users, such a kind of sniffer. He laid out the collected passwords in open access, and, apparently, he was not the first to receive passwords in this way.
It seems that the danger of using anonymous proxies was warned a long time ago, but this case clearly showed that anonymity is not anonymity from (not for) everyone ...

Could Tor be a massive hacker conspiracy?

References:
The abductor of the accounts of diplomats questioned by the police
Hacking passwords of dozens of diplomats: details
Tor Project
What does Google know about this?