I know eBPF is safe and all that. Personally I think that a kernel level Tor gateway is bound to have my workstation's cunt roasted off should there be an eBPF exploit.

Fair concern, but eBPF here only tags local sockets fwmark all untrusted network traffic and Tor crypto are parsed safely in userspace via Arti!