What does max 2 million tor users mean? Anyone can install the Tor browser or view it through Brave browser. I assume you mean the existence of IPFS http gateways? Well there is nothing preventing a tor gateway from exisiting in exactly the same way. I assume the only reason it’s not common is the gateways would receive too many abuse reports due to the content typically hosted on onion sites. This has nothing to do with tech though.

DDoS resistance is an issue on Tor but it has been shown that you can mitigate it. That’s one thing IPFS should win by default.

And for privacy, Tor is pretty much the best you can get. It’s not bullet proof but it is the safest tech in existence. For DHT based technologies you can literally query the DHT and get the ip address of every single person who has a copy of the files. This is way way less private than tor, it’s less private than a standard clearnet website.