The source is “this is a known weakness of tor and always has been”, there have been a number of white papers and conference talks on this over the years.

When tor was developed it was known what the weakness was. Mitigation is possible, but you can not certainly say 100% that tor will anonymize you, unfortunately.

The exit nodes being the weakness in tor has always been known, any actor capable of monitoring and capturing enough traffic on exit nodes can correlate it, at that point you have to track it.

Tor alone can not protect you, but it is a pretty significant tool. You need defense in depth if you intend to protect your identity.