If the host PC is pwned then it can still disclose useful information about itself (files, Geo locations, mac addresses) - it will just be routed over TOR.

True. So it must not contain anything that's associated with you, in any way. Buy with cash. No geolocation data. Dedicated LAN. No sneaker net sharing. Compartmentalization.

Totally agreed. I nearly edited my comment yesterday to include this actually.

It is just one potential brick in your security wall.