Firstly I have to say the comment posted by holahola is spouting lies and FUD. Tor Project had nothing to do with Freedom Hosting or it's take-down. Freedom Hosting hosted everything without censorship, and because some people used that for child porn, the FBI attacked it. They got to it because they found the owner because of completely unrelated means for sending a lot of money into Romania or something. They checked him out, and found out the also owned Freedom Hosting. That's all that happened, no Tor Project intervention. As for your comment about "forgetting" to update, that's retarded. Tor Project does not comply with law enforcement if it requires them compromising Tor. Even if they did try, it would be very difficult to get away with. Now when you say you have to be a programmer to be 100% protected, just stop. You should NEVER IN A MILLION YEARS roll your own crypto, or crypto implementations (or anonymity networks). I guarantee you will be more anonymous if you use Tor than if you use your own network, unless you have the brainpower of a large amount of coordinated, intelligent programmers and researchers. Not only that, but in general your comment seems uneducated and overly paranoid, but not in the good way (i.e. you fail to mention the most common and dangerous attacks, and instead spread FUD).
Secondly, to answer OP's question, short answer is "very well protected", long answer is "it depends". Here is a quick overview of how Tor works. Your computer picks three relays out of the pool of about 5000 (the third relay must be an exit node, of which there are about 1000). It creates a circuit using those three, so the first node (guard or entry node) only knows what middle node you are using, and who and where you are (from your IP address), and how much data is sent, but it does not know the contents of the encrypted connection, the website you want to connect to, or anything else (put simple, the first node knows who you are and who the middle node is, but not what you are doing). The second (middle) node knows even less. It only knows how much data is sent and what entry node and exit node you are using, but it knows nothing about the content of the communications or you. The last part of the circuit is the exit node. It knows the most. It knows, along with that middle node is used, what websites you connect to, and if the website is not secured with TLS (https), the contents of the web page or any data you send to it (including your passwords if you send them to an unenecrypted website). The vast majority of exit nodes do not actively "sniff" this data, but be aware that a malicious exit node could if it wanted, but as long as your online activity does not give you away (like signing into your own e-mail or Facebook) then it should be no problem. Now, the whole idea of Tor is making the chance that the entry, middle, and exit nodes are all owned by a malicious entity as low as possible, and as long as the entry and exit nodes (and to a lesser extent, the middle node) are not both malicious, the circuit will remain anonymous. So Tor Project (well, the onion routing method in general) works around the issue of trust by developing a system which is very fault tolerant in the case of a breach of trust. To tie this to your question about how well protected you are, the chances you will be deanonymized by traffic pattern analysis (analyzing the exit and entry node to see correlation, which requires being able to monitor both at once) are very, very low. Even the NSA has great trouble doing this (I don't think it ever has), and the only threat to Tor in this aspect is a so-called "global passive adversary" (an adversary with the capability of monitoring all communications in the world, passively). The NSA tries to be a global passive adversary, but it is limited.
However, don't feel 100% safe yet. There are still other, easier ways to deanonymize you than monitoring a large amount of the Tor network at once. However, you should note that these techniques only work for an adversary that wants to know who is visiting a website, not what websites are being visited by you (i.e. an attacker cannot deanonymize you on the ISP or Wi-fi level, you are entirely safe from that). The deanonymization methods can bypass the security of Tor itself by targeting the web browser, which is by far the most complicated part of the Tor Browser Bundle (and thus has the most "attack surface area"). The web browser tries to be secure, but if you enable scripts, an attacker can feed you a website with malicious javascript (either by compromising the website itself, the website's ISP, or if you are not using TLS or a hidden service, by modifying the contents with a compromised exit node). The javascript may have the ability to exploit your browser and possibly even compromise your entire computer. In order for this to happen, the attacker has to be skilled. Activating javascript isn't a death sentence because most vulnerabilities are fixed soon after they are found, but the javascript engine in Firefox is so complicated that vulnerabilities are found all the time, some of which are very severe (so-called "arbitrary code execution vulnerabilities"). This is how the FBI compromised some Tor users after they took-down Freedom Hosting. They got control of the physical servers running Freedom Hosting websites, and injected malicious javascript (the "torsploit") which attacked any Firefox web browser using a version older than 17.0.7 or something. The attack caused all computers with scripts enabled to run code which bypassed Tor, and sent some basic personal information to the FBI about your computer (anyone with scripts disabled was not affected even if they loaded a compromised site). If the FBI wanted, they could have easily changed the exploit to give your computer full-fledged spyware, or recruit your computer in a botnet, or do anything it wanted as if you downloaded and ran the malicious code yourself (do NOT rely on any anti-virus software to have any chance against such browser exploits). My recommendation to stay secure from this deanonymization technique is to keep javascript disabled globally, and only enable it for specific sites if you really, really, really have to. Even something like Wikipedia could be potentially compromised, or a malicious exit node that has access to Wikipedia's private key (which only organizations like the NSA could potentially do) could inject malicious code (if you are using Wikipedia with TLS, aka https, then under 99% of circumstances the exit node will not even know what article you are viewing, only that you are on Wikipedia), so do not enable javascript for "trusted" sites either unless you need to. Of course, it is theoretically possible that an exploit could target the CSS parser, or the image renderer etc. (which remain on even if you disable scripts), but this would be extremely difficult and an NSA-level adversary is unlikely to use such an exploit on you, even if they do know one (which is a stretch).
To respond to your question about punishment, I can't answer. I don't know what situation you are in, where you live, what you are doing, or any of the unique laws you are under. I can say that in the majority of places, Tor is entirely legal to use. If you do something illegal through Tor and get caught (e.g. by an exploit, or more likely by accidentally telling someone something you shouldn't have), the punishments can be more severe because you would be accused of not only the crime itself, but of taking efforts to hide the crime using technology (i.e. Tor), which in the United States at least causes your "punishment" to be bumped up a bit. If you are actually planning on committing a crime though, it'd still be better to use Tor than not.
For your final question about how secure Tor is compared to proxies or public Wi-fi, it is much more secure (and anonymous). Most proxies do not actually encrypt your communications, so an adversary monitoring your ISP will be able to see what websites you are viewing (although an adversary monitoring a website would not be able to easily know who is viewing it through the proxy). Proxies are also often untrustworthy, and many "proxy lists" out there have honeypots, or are composted of botnets, and should not be trusted with your data. Even if you do find a secure, trustworthy, and encrypted proxy, it will still be much easier to trace you down because of not only the single point of failure, but because one node gives much less protection against traffic pattern analysis than three. Also note that Tor has several extra features that prevent against pattern analysis such as padding every "cell" (a unit of data) until it contains exactly 512 bytes. This makes sure that the size of any data you transmit can only be narrowed down with a precision to 512 bytes. Imagine this hypothetical situation. You connect to a website, and one page is 42,514 characters long and describes how to raise a cat. Another page is 42,836 characters long and explains how to create IEDs (homemade explosives). If you use a proxy, anyone monitoring your ISP who knows you are on that site will be able to tell if you are going to the cat-raising page or the IED page because they will see either 42,514 bytes of encrypted data passing through, or 42,836, even though they cannot decrypt any of it, yet they can still infer what webpage you are going on. Tor on the other hand uses padded cells, so viewing either webpage sends exactly 43,008 bytes of data instead, which is because 84 cells of data (technically 83 full cells, and one cell with 4% encrypted data and 96% random, but indistinguishable from encrypted, data) is sent over. This of course causes a little extra overhead, but it offers protection from some traffic pattern analysis attacks that even an encrypted proxy (or VPN) are more vulnerable to.
tl;dr
You are safe with Tor. You are very safe with Tor with scripts disabled and an up to date Tor Browser Bundle. In the United States punishments will be a little worse if you use Tor to commit a crime vs not using Tor (but it's still worth it to use Tor). And Tor is much, much better than public Wi-fi or a proxy which offer very little protection from any even remotely sophisticated adversary.
I hope this clears things up. Sorry for the long post.