Serious question, since Tor is basically the server-client which was finished a long time ago and then a browser that basically is a fork of Firefox ESR.
Well for one thing, it needs to defend Tor against many parties, some of them with essentially unlimited resources, who are working full-time to find holes to exploit.
Another place to look is their tor-project mailing list where in each meeting they list things to do/things done: (e.g. https://lists.torproject.org/pipermail/tor-project/2020-Apri... ) https://lists.torproject.org/pipermail/tor-project/