I frequently make that same argument about NIP-09. If you've shared something, you should forever assume someone has access to it. But if you aren't self hosting, everything that you do should be considered shared. At least with local files and code there is some semblance of privacy. Most don't understand this.