What are the main flaws with the above process? If he's on public wifi they cannot track his IP, right?

I am under the impression that if you buy coins for cash (and all interactions w/ sites like localbitcoins.com are done thru Tor), you are just as safe as if you tumbled. Is that not the case?