I’m not sure tbh, it seemed clever but I don’t fully understand what happened.

Nostr has encrypted DMs so that can’t really happen here. But there are new extensions like nos2x so clients can’t hypothetically steal your nsec.