Those user's traffic is cleanly separable at the destination, so this attack is always possible from some vantage point and isn't a defensible position. So malicious exit nodes are the real threat. Your reasoning would apply better to guard nodes.