Layers of security
Most of the known Tor busts involved a combination of Firefox bug and social engineering. (eg: The target ignored the download warning to watch a tempting porn file that caused the media player to phone home.)
Anybody doing enough business through Tor (or Bitcoin) to be noticed by the establishment should at least have a dedicated client computer and the wherewithal to piggyback on a public Internet connection.
Per usual, laziness and lack of discipline gets people busted.