My guess is that if you link to an untrustworthy Nostr app/PWA, that could be a problem as well. It's why I wish browser extensions like Flamingo would add PIN locks to them. In theory, any site could access your private key because the extension isn't locked. 

 Good call. I’ll have to avoid just hooking into any and all app on a whim. So, no nsec promiscuity. Got it.