The question for me is what if nostr is your only connection with them. Even NIP 44 is not private on the same level as Signal or SimpleX. But it should be safe to send a message saying "do not respond to this, contact me using SimpleX". With the new version, metadata is more hidden, but relays can infer things based on traffic, and account compromise can reveal history. That's not good enough in life or death scenarios.