> Not only was it detected immediately thanks to SSH printing that huge banner on MITM attacks
The thing is, that only helps Tor users who are happy for their PC to contain evidence of what they were doing over Tor (such as a known hosts file listing).
If your security requirements are so high your PC contains no evidence whatsoever of what you were doing over Tor, you wouldn't get the banner.
That’s actually a really good point, I remember from the Darknet Diaries podcasts that this is typically how darkweb operators manage their things, not using any storage and starting from a fresh machine every boot.