Don't all those crazy FBI/CMU/(NSA..?) correlation attacks require you to control some majority percentage of the relays and/or exit nodes?

It would definitely be interesting to actually come up with some estimates of how much was being spent in aggregate bandwidth costs, say, 7 years ago, and compare it with what is being spent at present, and see if it matches what would be expected with 'normal user growth' although normal user growth for a relatively niche project like this would be pretty hard to quantify.