Relays that are detected or flagged as malicious get quickly removed from the network, https://trac.torproject.org/projects/tor/wiki/doc/badRelays
More reading: https://blog.torproject.org/how-report-bad-relays
More reading: https://blog.torproject.org/how-report-bad-relays
What I am thinking about is the hypothetical case that 3000 of the 6000 active relays today had been started and operated by Eve over the last few years according to Tor guidelines and without any external sign that the nodes were centrally controlled.
If that were true it would be hard for a user to detect, and it seems to me that Eve would be able to reasonably easily break the privacy protection of Tor.
Tor circuits tend to go through many countries and rarely do they go through the same country twice. Not sure if this is part of the node selection criteria. But if you can’t have two nodes within a circuit go through the same country, and someone identifies you, then you’re dealing with a hell of a global adversary.
FWIW I think many people are concerned more about being monitored by their local governments rather than foreign ones.
You can do that with a credit card and AWS. Setting up server presence in multiple countries is trivial. Setting up enough of them is expensive.