Yes it's like any other web browser app, so you shouldn't be using web apps.  We encourage people to use CLIENTS.  Nostr clients interact with relays in a way that assumes they are hostile.  The relay can't see the password.

While as protonmail is purposefully pushing people to their web app, because thunderbird or normal email clients don't work.  PGP should be done on the end client, not kept in the cloud.