It is not surprising that people assume Satoshi used ToR when scouring the internets however if my understanding is correct in order for someone to run a full node they need to provide their IP address so that other peers can connect with them. How did Satoshi manage to run the first full node without disclosing their IP address? Did they setup an anonymous offshore server via anonoymousspeech like they did with reserving the bitcoin.org address?
It's possible, perhaps even probable, that Satoshi did actually reveal their node's IP address.
The day after Satoshi published the first version of the Bitcoin client, Hal Finney sent a public email to Satoshi describing an issue that he ran into while running the client. Importantly, this email contained Hal's debug.log file which contained the full response that Hal's node received from the IRC server seeder that was in use at that time. This response contains the IP address of nodes that could be connected to.
From that debug.log, we can see that there were only 2 nodes that were announced by the IRC server. One of these nodes is Hal's as the log states. That IP was also known to belong to Hal. Given the timing, it's safe to assume that the other IP is of Satoshi's node.
Of course, it's possible that this IP is that of a VPN or a hosted server. However, looking up the information for this IP reveals that it is allocated to a Covad which is a regional broadband ISP. This suggests that the node was not hosted in a data center or using a VPN as they would likely have an ISP known to have data centers or provide bandwidth to data centers.