True! Outbox model works better for known unknowns. Unknown unknowns become harder, but if you request a list of notes signed by a given npub and verify the sig of each then that’s still a parameter you can use to avoid being spammed by the malicious relay.

You can at least retrieve tons of notes from everyone you follow that you might not have seen otherwise, like the hello world experiment from nostr:npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6 

If the relay model and Negentropy in the client, you could even send the list of note hashes you have for that npub so the relay would intelligently respond with only the notes you’re missing, completing their profile.