Exactly, one client can break everything, as is happening right now.

I am not dying on the hill of short simple URLs, but the fact remains that each client must tread carefully in order to be a good Nostr citizen. There is no world in which a decentralized protocol is robust against implementation attacks. It happens everywhere, HTML, RSS, HTTP, Fediverse, Bitcoin, probably many other places.