Nostr doesn't host images, so every post thay shows an image links you to another server. If I wanted to capture a bunch of people's ip addresses I could self host an image, include that image in a post, and then capture the ip address of the people that look at it (when they query it from my server).
Discussion
Nostr doesnt seem very safe if you dont have a VPN on all the time when using it…
A VPN is definitely a good idea, you can control which relays you connect to (they could capture IP) but linked media is definitely a bit trickier.
There were a few relays over TOR... would definitely be nice to see more of that.