Why so serious? The option to publish tipping/donation addresses has been around since P2PKH (and P2PK before that), and shouldn't be treated profanely as if a novel security vulnerability. It's just one address that's public. That you can easily keep separate from all your other addresses/UTXOs. This concept around Nostr has been congealing since at least 2023:

Can We Turn a Nostr Public Key into a Bitcoin Address?

Can We Turn a Nostr Public Key into a Bitcoin Address?