Discovery
Privacy
Lack of data control (for non-tech users who don't run a relay)
Spam
Filtering
Granted most of these are non-problems currently, because the community is small. But if a critical mass of attention comes to nostr, so will attention seekers of all sorts and the signal to noise will plummet. This will force relays to employ increasingly sophisticated filters, which will make it ever harder to run your own. This will create a centralizing forcing function.
This exactly what happened to email. Nothing prevents nostr from the same fate especially if it gains a wider audience who cares more about security than freedom.
The issues are solvable and Nostr is well-positioned to solve them but it isn't guaranteed. The only absolutely solid thing nostr has is users owning their own keys. The rest needs work.