Just authored a similar thought, and then noticed your reply. Yes, It's not a privacy tech. I'll bet future data mining will try to explore what can be done with nostr data, including all public notes and public meta data that people post.
Social graphs etc. Is absolutely possible to build, and not much extra known data is likely needed to a whole social graph. (knowing their geo location, interests, psychology)
It's best to consider nostr a censorship protection tech, and as you say; be mindful of everything being public.