There's privacy at the app layer (nostr identity) There's no privacy at the connectivity layer (IP address)

Not even. They just use random keys. That's not privacy. That's annonimity. You can still track the keys.