This discussion doesn’t make sense, because
Not true, the majority of Tor users are simply using it because it is easy to get started and they are curious. 
This is exactly what Nextcloud has done with the Suspicious Logins app, which I believe will soon be offered by default
Completely false. I read this as having no understanding of either, so just clarifying that these are two different things in every sense.
Also not true, because VPN’s are easier than ever to use now that we have Wireguard built into the Linux kernel and ready to deploy. If you are referring to the Tor browser bundle, remember Mozilla now offers their own VPN service within Firefox, meaning you would not even need to install the Tor bundle.
Conversations like this are confusing. My understanding is the concern is over threats from VPN’s and Tor users to a vulnerable public forum, but what I’m wondering is why you are not using these technologies in order make your service only accessible to trusted users to begin with (assuming this is an issue of critical importance to you).
Always.
If the threat you face is a state level actor, then yes. In that case you would be in danger because unlimited resources and expertise reach far beyond what we can anticipate. If you are in danger I suggest never exposing yourself (or your services) on the public internet, but I hope that isn’t the case. 