How do you know the IP in question was not the final hop of someone's VPN connection?

Sure, that's plausible... a facebook exec so dumb that they're using their personal ISP connection to run a VPN for others, and even dumber that they don't notice or don't care about a massive amount of torrent traffic through that VPN.

It's not really a VPN for piracy purposes unless it's a commercial, no-log VPN. Since when a VPN is used to move the point at which traffic enters the internet, the owner of the VPN exit will be held to account.

They can try to claim they were running a "private" VPN and gave random people (from reddit and discord) internet access through it. They can try to claim they don't keep logs. Meanwhile, for a facebook VP with suspected activity tied to facebook corporate, the rightsholder will subpoena every digital device in the person's home, depose all their family and close friends, subpoena their facebook email...

Are you confusing Tor with a VPN? With a VPN the IP is a commercial server run by the VPN provider, and there's usually just one hop (you run an encrypted connection between yourself and the VPN provider that all your traffic is routed over, then the VPN provider makes outgoing connections on your behalf). You're relying on the VPN provider's promise to not log customer connections, but if they are honest, all connections seem like they're coming from the VPN provider and aren't traceable beyond that.

With Tor, you connect to a random Tor node (which may be another residential computer), which connects to a node in the middle, which connects to an exit node, which forwards your requests on to their final destination. All connections look like they come from the exit node, which might be someone's residential IP.