Roskomnadzor can block whole AWS and there will be neither rioting not even a significant outrage. They can even turn to whitelisting. The only reason they don't do it is that it is still considered unnecessary.
The reason it is considered unnecessary is that the existing blocks work enough to cover the most of the population, who aren't technically savvy enough and would not bother to take the special effort. This is enough to lower the reach of sources that contain information not approved by the government to where it doesn't pose any danger to the regime. The same concept as "kitchen talks" in the USSR, only on the Internet - you can have VPN in your own "kitchen", as long as it stays there it will be ignored.
So, if Tor browsing becomes easy enough for a common citizen to use, they will disrupt it just enough so that common citizen won't be able to use it, and would stop there.
The reason it’s unnecessary is because current mechanisms are enough to stop Google and FB from making money on Chinese citizens, which makes it unprofitable to spy and manipulate them.
They've already got their hands on ProtonVPN, Nord VPN, Opera VPN and a number (about 8-10, I think?) of others.
Their system analyzes all the traffic and tries to identify VPN packets, so I don't really see why wouldn't they block all the providers should they need to.
There are still ways to mask the traffic, but a regular user can only be bothered so much.
Yes, many businesses rely on VPN, but I can imagine that RKN might just come up with some great white-list idea.
"Rubber hose key extraction" is a USA idiom representing a beating with a rubber hose with is supposed to be a way to inflict pain without leaving lasting marks so it can be used by the authorities to extract information without leaving evidence of the beating - IIRC there are recorded past cases of some sheriff's departments doing this.
Other cultures don't bother as much with the aspect of leaving lasting marks. The equivalent Russian language idiom is 'thermorectal cryptanalysis' which involves a soldering iron inserted into the anus and is expected to reveal passwords of any length within a minute.
There are plenty of VPS providers in Russia, and many users have already been forced to move there because Visa and Mastercard made impossible paying for foreign services. (It is very difficult to find some action more harmful to anti-Putin dissidents and beneficial to Putin than this ban!)
