Privacy isn't about secrecy, it's about ownership of personal data.
Because Nostr gives you more control, it gives you more privacy. Does it give you more secrecy? No, unless you remain anonymous, which his account is not (he may have a separate anonymous account for all we know. That we can't know is the point).
Is it really privacy when everyone owns your data? It seems rather public at that point.
It depends on what you value more.
You have more right to portability than in any (other) platform (it's trivial to pull your events from many relays).
Whether those who access your data will use it for illegitimate purposes isn't a technical question. Doing so would be illegal regardless of the technology.
