Are seatbelts and airbags broken because people still die in crashes? Most security mechanisms can be circumvented by a sufficient state actor. For most purposes, when not being targeted, Tor does its job.