They can monitor enough relays to pwn a few of the people some of the time. In contrast, they can run enough i2p and and Freenet nodes to identify (though not pwn) almost all of the people, all of the time. On i2p, they could probably pwn some of the people, some of the time. On Freenet, it is unlikely they could pwn anyone, but you couldn't run a service like SR on Freenet. And with any one hop proxy or VPN, they can pwn all of the people, all of the time. So those are your options.