If they run behind Tor then yes they are protected, but do they? most of the relays I see have a domain and ip address?

Perhaps it is a good practice to start hiding Nostr relays behind Tor?

Number of relays won't matter if it is risky now one will run any, or they will run private relays (which is maybe not a bad idea?)