Tor Hidden Services are primarily designed to protect server operators and don't add any additional protections for the users (except perhaps the fact that if the server operator is using a hidden service it's less likely that someone can be squatting on an upstream router attempting to correlate your traffic). However, hidden services can still be compromised by attacking the server or other software directly (ie. going after a vulnerability in Apache or Nginx). The hidden service can then be used in turn to attack the users of that service.
I'm not aware of any research into end-to-end correlation between a user and a hidden service (as you said, most of that goes towards users of Tor exiting to a normal web service), but I'm sure such research exists.
The other case one must consider is are services that are on the public internet and also provide tor hidden services. In this case the hidden service is not actually protecting the server operator (since they're operating publically as well), but it does mean the user doesn't have to trust an exit node (they always stay within the Tor network and only exit directly at the end point). If the hidden service is 'unofficial' however (run by a random person proxying to the end service), no benefit is gained. In fact, at this point, the person is essentially trusting a single effective-exit-node and doesn't have the option of changing their exit node by building a new circuit (it will always simply be the owner of the hidden service doing the proxying). So trusting a service that's not operating completely within the Tor network could potentially make correlating traffic that much easier for a determined attacker.