The attacker cannot watch connections to the hidden service until they realize that they can trivially trace it to three entry guards with the brute force circuit construction attack, and then it is as anonymous as someone using *three* different non-stacked one hop proxies. Also attacker may only need to run the introduction nodes of the hidden service. For popular hidden services like SR the introduction nodes change rapidly because the clients DDOS them.