Im sure fiatjaf would have tightened up his practices a bit had he known he would be targeted. Normies couldnt care less and will never consider their problems a symptom of their laxity, however, a well thought out threat model and privacy practices will do more than you suspect. Its tough though, ive had this account for less than a week and have already had 3 accidental leaks, whether that be vpn downtime, non anonymous tips through an old kyc wallet, geolocation,etc.
Discussion
It's a very tough ask, and beyond the skill of a normie, who doesnt want to be educated. The issue is that nostr is marketed as freedom tech so normies will have a false sense of security, and do or say things on nostr that they might not elsewhere. In this regard, nostr may harm them more than it helps.