And a single hyperlink Trojan horse that sends them to a web nostr client, opens the private chat and adds them to it.

I click and oops, you're in.