This is at the root of Nostr, however.
An open and public network that enables things like social media where you own your data means that *each person* has to take personal responsibility to preserve privacy where they want it.
The easiest ways will be only using relays you trust/control and using a always-on VPN on all devices to hide true source IP.
Outside of that, people should assume everything in Nostr is public and act accordingly.
That is totally fine and should be a similar expectation as centralized social media, except that in this case *anyone* on your relay(s) can see all of that data, where as with Twitter etc. only Twitter and 3rd-parties they share with can.
If you make much of the data we're putting into Nostr private by default, it will be a pretty poor social tool.