Yeah I'm guessing this is a false positive based on heuristic analysis, i.e. the TOR program has a lot of the same behaviors as malicious programs. Of course it is more accurate to say that the malicious programs are copying TOR behavior or just straight using TOR code, whatever the case may be.
My main issue is that it kind of shows a lack of due diligence. I assume the official TOR binaries are signed, so the official TOR binaries should be exempted from these heuristic positives. If the binaries are unsigned/have no valid certificates, then I can totally understand the false positive. At that point, the user should know they are installing software that cannot be automatically verified as being safe, and antivirus should never assume that something is safe otherwise. Like you said, for typical users this should be the expected behavior. Users can always undo Windows Defender actions and add exemptions.
NLRB changed their criteria for what is considered co-employment last month, widely broadening the definitions used to determine this status. Essentially, if a company has significant control (not just exclusive control) over any of a worker's employment status or conditions, then they are considered a co-employer now. It used to be that a company needed exclusive or overriding control over another company's employees to be considered a co-employer.
I'm certain we are going to see more lawsuits and legal challenges from employees because of this. I'm pretty certain there already are lawsuits from some other Google contractors over this exact thing; they are providing a case that Google is their co-employer due to the control they have over every aspect of their work.