the thing that helps make sure of it is well known clients that have default logged out feeds of legit people

if people are dropping links to fake clients then yeah, but this is a general web phishing problem not anything special about nostr