It depends on how bad they want to find out. You can cut off opportunistic doxxers with basic security practices: VPN, password manager, code-based 2FA (not SMS). Your activity on nostr still travels over the internet, and metadata about that activity is the smoking gun.

A determined attacker will always find a way, so you have two ends of a spectrum: don't draw attention to yourself <-> have exceptional security practices. Find a spot that's comfortable to you.