Half of that holds, and the half that does not is the VPN. A VPN swaps your IP and leaves the rest: TLS handshake shape, header order, timezone, screen metrics, and above all the logins you repeat. One provider sees all of it, while Tor splits the knowledge so no single node knows both who you are and where you are going.

Tor Browser's defense really is uniformity, so hands off is right. The leaks I would watch first are a window resized outside the letterbox steps, an add-on, and the same account signed in with and without the circuit.