Can exit node tamper traffic before sending it to endpoint? I know it can see it, but the question is, can connection be spoofed, if non-encrypted protocol is used, for example usual HTTP or even TCP socket? Does Tor guarantee message integrity?
Yes, the exit node can inspect and tamper with the TCP traffic as it leaves the network. It's impossible for Tor to provide integrity for this traffic. You should always use secure protocols like TLS/HTTPS over Tor (and even when using the Internet outside of Tor).