What is preventing the "Exit Node" from tampering with the message going to the server, or the message coming back to the user. As far as I understand, the "Exit Node" can read the unencrypted message, and there is nothing stopping it from tampering with the message, adding some sort of Trojan?
The Tor Project monitors exit nodes and if one is found to be misbehaving, they can make sure that it has a "badexit" flag on the network and no middle nodes will send traffic there.
There is a community at Tor that specializes in bad relays. Check out their website if you want to know more about what they do.