You can get a gist of that by looking at what they do for each sponsor: https://trac.torproject.org/projects/tor/wiki/org/sponsors (e.g. https://trac.torproject.org/projects/tor/wiki/org/sponsors/S... )

Another place to look is their tor-project mailing list where in each meeting they list things to do/things done: (e.g. https://lists.torproject.org/pipermail/tor-project/2020-Apri... ) https://lists.torproject.org/pipermail/tor-project/

Well for one thing, it needs to defend Tor against many parties, some of them with essentially unlimited resources, who are working full-time to find holes to exploit.

Yeah, when you can credibly consider the NSA as an adversary, you need a strong team

They don't have 35 engineers

What even is not engineering?