correct - this is what the WhiteHAT guy did few months ago doxed geoip of many in realtime - just to demo. Also any CROSS-LINK to CDN server can see who is loading image/video - this has nothign to do with nostr. only TEXT notes are covered in this topic