[Astarte]

>While Tor browser is very well hardened, relative to Firefox

Some say it is one of the most attacked browser ...

>However, we have no clue how many users in authoritarian regimes have been pwned by similar malware, over what we'd call human rights issues.

Maybe not as much as you believe. The OP is talking more about traffic correlation. The FBI's attack came from the browser, this can also aid in correlation attacks but was irrelevant in the FBI's case. In authoritarian regimes you can just attack from the network side and log each IP which tries to connect to a Tor node. Then you visit those people personally. Or like in so many authoritarian regimes you just block Tor completely. Neither a firewall or Tails or Whonix will protect you against traffic correlation attacks.

[Santosh83]

You can use unregistered obfuscating bridges when the Tor protocol is banned. Not sure how effective that is though, since I've never needed to use them.

[Astarte]

I'm not sure about their security either, see my other post below.