Wow I didn't even know that. Really bad.

But in general, the Nostr protocol is just not private, but pseudonymous - and thus succeptible to the same dragnet-style surveillance as Bitcoin. You just need to collect enough metadata..