The security model of Tor allows the exit nodes to see all the traffic in 'plaintext' (indeed, the design of Tor requires it). What the security model requires is that the exit nodes not be able to identify who sent the packets originally.
I put "plaintext" in quotes because they can only see what you want to send to the server, which could be encrypted outside of the context of Tor.
Although I think it is illegal to spy on the data you pass as an exit node, a point that is often not said is that by the design of Tor, you are showing some random person the content of all of your requests, which opens up a whole new attack vector for eavesdropping and man-in-the-middle attacks.
