This is why I only use web clients so I can control them using, either my own custom extensions (nvault) or uBlock origin for example. I even use a javascript injector extension to fix my own issues dynamically on web clients.
At a minimum for new nostr clients, typically I blacklist all 3rd party connections and websockets - except for the popular CDNs and my trusted relays. That's it. Everyone else can GFY.
