Nostr doesn't have a set wallet. Some clients have their own built-in wallets, and sats sent to you through them can be locked to your public key, requiring a signature from your private key to move them. In that case, though, the "sats" are actually eCash tokens representing sats that are in custody of the eCash mint that issued the tokens. That mint could rug you at any time, and you would only know when you try to have the sats sent to another mint or another lightning wallet.

A lightning wallet is only self custody if you are running the lightning node it uses for routing payments through the node's lightning channels. Here are some examples:

Alby Hub wallets are self custody only for the administrator of that Alby Hub instance. Any other hosted wallets used by friends and family are custodial. The administrator could rug them at any time.

Zeus' Olympus wallet is self-custody. The node is operated by the wallet user, who has to open lightning channels in order to transact.

Primal's built-in wallet is fully custodial. The node that services those wallets is run by Strike.

Coinos wallets are fully custodial. The node servicing those wallets is run by Coinos.

Hope this helps.