Ahh looks like the tos is only parsed as post on the /tos page and not in the register step will fix that.
For my huge community, it is currently absolutely unacceptable, that users can register without confirming their E-Mail and then read/browse the forum. Is there any way to stop this? (Suggest: Put new users without an E-Mail into a unregistered-users group)
I'm fairly sure there's an ACP setting for this. Have you tried running through the search results for "regist" and "email" in the Admin Control Panel?
Currently, restriction on email verification will stop a user from posting replies, but not reading.