If it’s not “private by default” then can it ever be safe for regular users?

Or does a newbie introduction to nostr now require a lesson in VPNs and onion routing?