Exit nodes can be monitored, easily identified
Discussion
if you are not a high target you are probably safe enough with tor
or better, the most crucial infoleak would be "this person is using tor" probably doing shady stuffs so now he is a target...
Still likely better than leaking your IP to the DOZENS of servers it normally would be leaked to using NOSTR. Only a few weeks back there was a bot posting npubs IP address just to prove a point.
A VPN at a minimum.
Yes exit nodes are public data. The point is to obfuscate your IP<->npub link as much as possible.