In the NIP-46 protocol, the signer that stores the nsec does not expose the nsec. It only receives signing requests, completes the signing, and then sends the result out.
nostr:note1zhvanadlce4fm2svryk9e3wvw97q066zlq27wn9lcjav3lau5klq8f4mwh
Discussion
Yes, but how is it the signing done? Via network comms right? So if the signer requires network access to work, then the dev pushes malicious code to publish the nsec, there's nothing you can do about it. Whereas nip 55 I can box up the signer with 0 network access so even if malicious code is pushed, it can't be transmitted.