is this a threat to tor?

Yes if an adversary controls both a user's guard relay and a middle relay for one of the user's circuits, the adversary can know what exit relay was used for that circuit by the client (and the time it was used). But this doesn't really help the adversary since it doesn't tell them what the user was doing. Instead, they will try to control or monitor the guard relay and exit relay for a user's circuit; the middle relay doesn't matter. This allows the adversary to link the user to the domain of whatever website they're accessing.