The traffic is only unencrypted if the destination traffic would normally be unencrypted. That means that an exit node can't MITM what would already normally be an HTTPS connection. It's a small nitpick grammatically, but the distinction is an important one.

Edit: Another potential concern that I hadn't thought of might be pavki's concern for traffic correlation attacks, but that's entirely speculation on my part since they haven't provided any clarification to their original comment.

No, traffic sent through tor is encrypted all the way to the exit node. From there, it's in the clear (how else would the data get to its destination on the open internet?)

VPNs are exactly the same. They're encrypted to your provider and cleartext from there. Except the VPN provider knows exactly who you are because they see the IP you're connecting to, in addition to the content. A tor exit node only sees the content, but does not know the source.

No matter how you're connecting, you need to ensure you are running encrypted protocols (SSH, https, ...) to protect against whoever relays your traffic. Tor, VPNs etc do not change this.