The security risk is not learning now to run your own nostr clients or relays locally.

Blindly trusting an “Nostr app” that you downloaded and subscribing to tons of relays is definitely a risk too.

Normies need to learn

Nostr (Notes and Other Stuff Transmitted by Relays) is an open protocol with main goal to achieve decentralized unstoppable communication.

And it achieves freedom of speech because people can choose different relays. If one relay blocks you (your npub or IP) another one won't and you will be able to continue to communicate.

Security is in the hands of the users. If you connect directly then the connection relays will know your IP which reveals your location - city, country.

Users can decide what personal information they add to their profile or reveal in their notes. They can so called dox themselves or stay anonymous.

Anonymity is achieved by using VPN or Tor to hide your IP and not revealing any personal information - name, address, country, dob, phone number, email ...

Other than that it depends what client for Nostr one uses. If one uses web client then some browser info can leak about the OS used and settings of the browser. That is fixable too.

Here are listed clients, relays and what not https://github.com/aljazceru/awesome-nostr

I would say Nostr is much better than any other alternative where for access is required phone number or email or other personal data.

interesting. keen to know more ☺️