Distributed isn’t decentralized. The only reason this is debated is because nostr hasn’t faced any real attacks yet.
You seem to be saying that the solution for average folks is to understand onion routing and use VPNs. That seems unlikely and impractical. For average folks, if it’s not safe by default then it’s not safe at all.