Did I undertand it properly that they was able identify connections from tor browser to onion service?

yes. it's an old attack, it will always be possible in the design of tor network given enough data and the overview of the network. there are two ways you can counter the attack. either constant bitrate with decoy traffic (super wasteful) or high latency services (think email with 24h delivery time).

Isn't this sort of attack mitigated by massive use?