Its a fair argument. I think incorrect tor setup is a bigger risk for things like securedrop leaker stuff, where it is likely the first and only time the user will use TOR.
I agree about securedrop, but the blog post seems to discuss “platforms such as Facebook, the BBC or NYT”.
Also in the case of securedrop it might make sense to have that separate from the rest of your infrastructure, so the “hidden” part of “hidden services” suddenly becomes useful.
