You are conflating a lot of concepts together, so let me try to separate them.
Virtual machines are a convenience of many purposes but enhancing anonymity is not one of them. Yes using a browser in a VM will give different indicators such as User-Agent and Fingerprint, but that’s just another set of tracking variables. It’s extremely difficult to configure your own browser for privacy. When browsing with Tor, you should be using the Tor Browser Bundle (TBB). TBB has all of the security levels configured for you as well as some privacy capabilities completely lacking in other browsers. It’s designed to look like the same TBB everyone else is using.
Theoretically Tor is indeed traceable and the Tor project will confirm that. The details however make it very very difficult. In general it requires monitoring or control of multiple nodes in multiple countries that are themselves changing. Tor is designed to resist a nation state level of effort. Multiple nation states working together can at least partially defeat Tor, but that is a high bar.
Last but not least, Tor doesn’t protect you from giving away your identity. If you login to an account both with and without Tor, you’ve correlated the two.
Tor is an anonymity transport mechanism. It will transport anything, including identifying information if that’s what you feed it. TBB is a browser configured to protect privacy and use Tor transport, use them together!
Also, you (or TBB) define and setup the multihop Tor circuit. Your machine knows the full path to a web page (not an .onion). Any sufficiently privileged code or trojan on your machine can see it as well.
Tor is not perfect, but it’s very good if used carefully.