If you put your nsec into a client, then that client has access to your nsec. The question there is, what, if anything does that client do with your nsec? So if you are on Primal, and you enter your nsec, does Primal send your nsec back to a server someplace and keep your nsec for nefarious reasons? This is why you might use a browser extension like nos2x or Amber on android.

In your last paragraph you discuss the servers (in #nostr we call them relays) being centralized. If you go to this page, and give it some time to load, you can see that there are hundreds of relays all over the world.

#Nostr relays are very decentralized.