I think you are forgetting that I can connect to all the relays as @jack using his npub, but it doesn't mean that I'm Jack. And if the relay records my IP as being Jack's, well that's the relay's problem. In other words using just your npub you are not losing any privacy. Btw, if you are not using a VPN, then your privacy is completely shot anyways
Discussion
I'm not forgetting anything, like I said before "relays see your IP when you connect, it can be linked to your npub when you post/react/etc. "
Connecting using an npub is not the hack you think it is, since you are unable to perform any actions so the relay can't link you to anything anyway. You could very well connect using your nsec and not perform any actions and achieve the same outcome.