yeah its a real concern, the idea of third parties controlling what you connect to and then monitoring your REQs. also outbox can make your client interact with rogue relays that could DoS you or send ads/spam to you for things that dont match your queries. this was the main motivation for me to create nostrdb so that my clients would be robust to these kinds of attacks if we ever decide to have it as an option on ios (client only trusts results from nostrdb, relays just dump data into there) set relay lists are still useful for organizations and if you just want to post to a platform that you trust, so i dont see it as outbox is always better. tradeoffs.