There is a NIP already to introduce PoW for spam mitigation. If that's implemented at some point, relay operators would not need to exclude Tor/VPN users, they could either demand payment in sats or proof of work for peers, that only want to connect to that relay occasionally.