The OP makes many assumptions about why people are using Tor. Some people are not looking for total protection from all the enemies Tor is meant to protect against.
For instance someone looking to hide from a local tap, say while at work, can safely use tor to login to account they would normally access directly. The enemy isn't the website you are accessing, or some nation state with limitless tapping resources. You just want Tor to hide what you are doing from the boss. (But make sure you aren't sending your login details in the clear.)
Tor is a less than ideal solution to the problems of censorship or local traffic monitoring. It would be more performant, and in some ways more reliable, to use a VPN, SSH tunnel, SOCKS proxy with SSL, etc.
In many environments these are also less likely to be blocked or detected by network operators, as they're a common component of business network traffic, while Tor (identified by communications with publicly listed Tor nodes) is not.
Tor was designed for anonymity, not circumvention. Circumvention is a side-effect of Tor and some circumvention features have been added (namely bridges), but there are significantly more elegant solutions for when only circumvention is necessary.
That's just what I'm saying - bypassing censorship is not a primary design feature. Tor's original design was only for low-latency anonymity. Circumvention was initially a side-effect of Tor functioning as a (very slow) proxy for its users, and later dedicated circumvention features were added (unlisted bridges, obfsproxy, etc) to make Tor more durable in hostile environments, for the purpose of making the anonymity features more available, which of course reinforces the side-effect of Tor being useful for circumvention.
Most recently, the rendezvous system and hidden services have been particularly powerful in reducing censorship on the end of content publishers, but this feature was added two years in, it is an area in which Tor performs significantly more poorly than, e.g., i2p, and very few people are actually talking about this when they discuss using Tor for censorship evasion.
I love the Tor project, but people should understand that it is an anonymity system, not an anti-censorship system. When you are facing censorship on your end (the reader's end) and do not require anonymity, just use a SOCKS proxy or a VPN. They're radically faster, often easier to use, and there are a million different options for evading blocking and detection - using DNS queries as a covert channel is a popular one, but the sky's the limit.
If you need to evade censorship on the publisher's end, then this generally comes down to an anonymity problem (the publisher must remain anonymous for their protection) and so onion-routing becomes a reasonable approach. This is relatively uncommon, though, and I believe people should more strongly invest in other projects that originally built around this goal, rather than having it added later. Some of these are more robust against attempts at direct censorship (rather than just punishing the creator) as well, as Tor is relatively centralized.
They have the "Do not mix Modes of Anonymity" section from the Tor docs. It clearly says that there's mode(3): only location privacy, no anonimity. The State of the Onion talk at 32C3 mentioned using Tor for non-anonymous usage, e.g. for securely getting to Facebook via their onion service.
Your boss would just have to put a keylogger or use something like Ammyy in silent mode to see what you're doing (I assume Tor usage is visible in the firewall logs hence making you suspect, but I really have no idea).
If "they" have physical access to a machine, you shouldn't trust it.
For instance someone looking to hide from a local tap, say while at work, can safely use tor to login to account they would normally access directly. The enemy isn't the website you are accessing, or some nation state with limitless tapping resources. You just want Tor to hide what you are doing from the boss. (But make sure you aren't sending your login details in the clear.)