Possibly and probably, that’s why you still have to protect yourself by not posting specifics… anyone can plug a npub into any client and potentially see everything that npub has done, the protection to that is that, only an nsec will sign a note or other stuff so they can see what you did, but can’t pose as you. Eventually hopefully clients will have more protections, but remember how secure the internet was in 1992… that’s where Nostr is right now