How your idenity on Tor could be leaked

I want to start a discussion on how tor works in keeping your real IP private and how it could be leaked. I will share a few examples on how it works from my understanding. Correct me if im wrong tho ;)

So imagine someone in different situations:

1. User using tor browser on a windows OS

2. User using tor browser with vpn on a windows OS

3. User using tor browser on linux distro

4. User using tor browser on linux distro with vpn

5. User using tor on tails or whonix OS

So i imagine that for 1 and 2, the OS can be infected with some kind of malware either through a downloaded file or perhaps javascript. Even when using a vpn, when the user disconnect from it, the malware could reveal the real ip adres to an attacker.

On 3 and 4 you run into the same problem as 1 and 2. However i feel like it is far less likely to occur since its a linux machine. But to go deeper into the vpn side, they could release your ip if asked for it after your vpn ip was recovered all the way through tor. Which i dont know how likely this is.

For 5 i actually dont know for sure. Since on tails which is a linux based distro, all traffic goes tru tor and no files are saved on the system itself. Infection seems to be super rare to occur. And for whonix, kinda the same thing applies, where its very hard to pierce the actual os.

I feel even a downloaded malware file cant do that much harm here since its wiped on the first restart and all traffic only goes through tor.

That leaves us with the only option to somehow break the tor barrier. This is where my knowledge on this almost ends. As far as i know is that your tor connection goes through i believe 4 different encrypted servers or nodes before the final connection. Where the next node, does not know from where the previous one came from or something like that.

So how to even break this then? Even if one of the nodes in that chain has been corrupted or taken over, it seems to me it is still very hard to break a ip through that. Maybe of a minimal of 2 in that chain would have been taken by the same persons it could be done?

Then ofc there is still one other option to reveal someones real ip. Not sure how likely this is but i assume when someone is on a message board and reveals at least some details of himself or using the same account names as on the clearnet. (Think i got this from the docu dont fuck with cats on netflix) Or watching for mistakes in spelling of words or the way you talk in general to figure out someones identity.

So what do you think is the most common or most likely thing that is used or would/could be used to reveal someones identity? I believe the malware way on a weak OS seems the most probable way.