Regarding your second point, I worked in IT at a large university about 15 years ago and set up an exit node briefly on a spare system I had. The IT security team tracked it down fairly quickly because of the sudden flurry of malicious traffic associated with it. So I had to shut it down fairly soon after I fired it up.
Most networks are likely going to have a similar reaction if running an exit node results in malicious activity on those networks. Ask yourself - who would willingly allow that to happen? It wouldn’t surprise me if the answer is organizations that want to monitor that traffic for one reason or another.