I could be wrong but this is not about a MITM attack but about a potential malicious nostr webapp that could be compromised. The app should still use a https connection which is encrypted so nobody in the middle can decrypt the information to read your nsec. A vpn would be used if you want to hide your ip adress from the webapp or from the nostr relays, not to protect your nsec.