The backend has to get more efficient for sure. It’s posting a nostr event with a link of your updated pfp to every relay you are connected to
I went to a web client (nostter) and got lost in installing a browser extension so I don’t have to put my private key in.
The web faces a larger range of attack vectors compared to mobile apps. There are some people on here working on solving the complexities around all of this stuff. Rabble’s interactions will probably lead you places