I'm not sure what is meant by cache hijacking. 

Re. session hijacking we might be talking about at least two things:
- vulnerability inside nsec.app such that someone gets access to your "session" in nsec.app
- vulnerability inside nostr app connected to nsec.app that exposes the app's session/connection info so that hackers can access keys on behalf of the app

The first part doesn't have much surface with nsec.app - we only use server to store encrypted keys and to subscribe to notifications for the signer to wake up. There's basically no "session". And any server-side auth is based on nip-98 which requires a new token signed by your nostr keys for every request, so again there's no "session" - you can only sign those tokens if you steal the main key. 

The second part doesn't depend on the signer (online or offline) - no matter which signer you use, it's the app that's connected to the signer that needs to be hardened against session hijacking. That's why it's super-important to not give excessive permissions to any (even trusted) app in your signer, so that potential hackers' access to keys was as limited as possible. Also when connection is established using bunker-url or nostrconnect url we use a one-time "secret" so make sure the connection can't be spoofed and url can't be reused.

I'm not a security specialist, and I agree that a formal security audit would be beneficial. We'll get there eventually.  

 Just to complete what brugeman said here.

When connecting with nip 46 there's a chance someone can pretend its the application you are trying to connect, but for this attack the attacker needs to know your relays and guess when you are connecting to an application 
To mitigate this there's a use secret option, in amber it's off by default because at the time most applications didn't supported this

For native applications using nip 55 I use the package Id of the app so if someone wants to pretend it's an application like amethyst they can't, the only way to do this is making you uninstall amethyst and install the fake app.

I'm also not a security expert so it would be better if we had an audit 

 Thank you for your response - very insightful.  💯 It confirms my initial thoughts — much appreciated your time. 👌👏