True on both points:
running a node is like
trying to shoot a moving target with bow and arrow
while running through the jungle.
And nodes are easy to identify and destroy.
Yes. And for nodes, if I was doing it, I would retrieve IP addresses from memo traffic, then shut it down, and observe those where those addresses connect later to find hidden nodes.
I suppose it would also be possible to observe miners and see where they get memo transactions from, and find it that way. I bet there are other ways to attack it too.
This of course is an arms race where both sides can improve their approaches, but most users would soon lose momentum in this war of attrition. And being a user could become illegal.