Yeah, the attack vector is much much larger than a centralized social platform. Instead of Facebook or Twitter knowing everything about you (which at least they protect). Here any rando could figure out a lot of things. Guess I should really not use nostr without a vpn. Though now sure how much that helps. Though VPNs somehow still leak a lot of information.
Centralized platforms knowing but "protecting" your information is a total fallacy they would like you to believe. Selling your information is how they got huge. They anonymize it maybe, but once it's sold it's out of their hands, and it is quickly de-anonymized, attached to a detailed profile, and resold.