Yes, it's important to set proper expectations when purple pilling. Nostr does not give you privacy by default. You still have to practice good OPSEC just like anywhere else on the internet. And, because of the data and metadata all these relays run by literally anyone have access to, maybe even moreso than usual.