One does not really 'break' an hashing algorithm. It is more about finding collisions.
While it is true that no collision has been found yet, this does NOT mean this will also be the case in the future.
While it is true that TOR does increase your privacy by routing through several nodes, it is wrong to assume that TOR alone does increase your privacy in such an amount
that you can't be traced anymore. You still can be traced (by powerful authorities) either via compromised exit nodes or meta data.
I'd say hardware and paper wallets both have their pros and cons. Both are definetly a secure way to store coins.
But most hardware wallets do have a PIN which is required to unlock the device.
So, even if a hardware wallet gets stolen this does not mean your coins can be accessed (assuming the paper-backup of a seed does not get stolen).