You're correct in the fact that nobody can see where the request is from. The exit node can see all the information you input to the website though. Passwords, logins, emails. Shit like that. If you don't want to risk your account being stolen I would recommend a paid vpn like NORD or Express...