First off, let me just say that the biggest issue people will find with Tor is not necessarily some highly theoretical attack, some vulnerability that can be found by crawling through the source code, or even some issue with the implementation of Tor in practice. What I find that turns people away from Tor is that they want something that will make them feel like they are in control and know what they are doing, but won't require them to put in the work to develop and defend their own understanding of Tor. I hear a lot of people talk about how Tor was originally developed by the US government, or give anecdotes where someone with all around poor op-sec got themselves compromised despite using Tor. If you press these people for a more specific and verifiable issue with Tor, you won't get a real response, because their position is not about whether Tor is actually safe.

But if you ask me? Tor is the best. There are probably a couple obscure mix-networks out there that could theoretically beat Tor if they were anywhere near as mature, but I'm skeptical.

VPN's are based on centralized trust. Tor is based on decentralized trust. But I've been working on a theoretical communication model that can achieve anonymity with zero trust at all. Most of my effort has been going into trying to prove that it's impossible, but no luck so far. I'd love to talk about it if you are interested.