I assume you're new to information security.
- It's an exposed service, if there is a bug in the software then there's potential to exploit it.
- Not in the way you describe, I'd be more concerned about libssl and friends.
- Not hugely, getting a memory corruption exploit working, especially cross-platform, can be a big challenge. It'd be cheaper to just run lots of relays yourself.
- Well tested and written code and fortified binaries, and an attempt to make the tor process operate with least authority where possible.
So, you're talking about an exploit worth $30-$50k (Tor Browser RCE is ~$30k, OpenSSL RCE is ~$50k so it's probably somewhere in between), putting the time and effort into weaponizing it for various platforms (probably requiring finding and chaining at least one other bug, mem disclosure, etc) all the while running the risk of being caught, having your exploit discovered and burned and then even if you do succeed you may eventually go to jail.
Or you could just sell the exploit or collect a bug bounty and buy relays legally.
Writing actually reliable (because if it crashes tor the sysadmin might come investigate that coredump) exploits for modern operating systems is actually a lot more difficult than the tech journalists make out and the experts make it look. 0days don't grow on trees, if you mess it up once and crash someones server there's a potential the whole thing will be lost and you'll be back to square one.
Consider also that a lot of Tor relays are operating on Linux and BSD systems, which means that even if you managed to compromise the Tor process, your compromise would only work until the next time the service was restarted. To actually gain persistence you'd need to write a local privilege escalation exploit for all the various platforms you'd weaponised your exploit against, another ~$30k for each platform.
So while it's not impossible it's really not a very economic approach and more likely to be the work of (skilled, bored) chaotic actors rather than someone with an agenda, there are much easier ways to yeild similar results.