There are plenty of ways to breakout of a VM. What if the VM has a filesystem that is readonly by the host?

Drive by download, cookie fs drop, etc. Attack the indexing server, file previews, etc.

You really want to run the VM on an external host like a raspberry pi and the VM should different than the host running Tor.

Tor should really be rewritten in a Coq proven Haskell program.