The thing is, who wins between Nostr and mainstream social media in terms of privacy really depends on your situation and priorities.

In the case of mainstream social media, you're trusting one specific party. If you trust that party, and if that party is trustworthy, certain things will remain confidential between you and that party. I can't know who you message, for instance. If the party turns out not to be trustworthy, or is attacked, information that you didn't wish to be revealed may became public.

On Nostr certain things that are normally confidential become public by default. If you don't trust any party, that's not really worse than what happens on mainstream social media platforms. If you, as most people, trust that mainstream platforms are at least very unlikely to ever reveal, for example, who you message, to the public, then Nostr is worse in this regard.

Of course, using Nostr there is the benefit that posts can be faked by another party, unless they have your private key or you are using delegation.