But no, we get people installing Tor and assuming now they are perfectly safe and using the same broken Internet tech, expecting a different result because the prinkled magic dust on it. Seriously? Windows and a buggy 'full' browser like Firefox was just a matter of time.
Have to second the views already expressed though about VMs, that is probably the way forward. Build Tor to run on the real OS and the VM can only see Tor. Let it break loose all it wants, still shouldn't get very far unless they can subvert the VM. Instead of a few Tor devels you have the entire hosting industry and VM interests working to detect and prevent that.