My guess is that if you link to an untrustworthy Nostr app/PWA, that could be a problem as well. It's why I wish browser extensions like Flamingo would add PIN locks to them. In theory, any site could access your private key because the extension isn't locked.