I think you are referring to the following lines in my write up:
“There are cases where attackers have control or observe certain relays and they can be used to see the victim’s browsing. However, such chances are also nullified because the TOR guard nodes are changed for every hop”

I have written this to specify cases such as Predecessor attack and Denial of Anonymity attack where the attackers can control certain relays. And yes, TOR guard nodes do change. Please refer the link https://blog.torproject.org/improving-tors-anonymity-changing-guard-parameters for complete details on the same.