Nostr doesn't scale, so it made the choice to (usually) host image/video content externally, rather than in the Nostr protocol itself. That's why random people can collect your IP addresses.

If Nostr was a well designed, scalable, decentralized protocol, this wouldn't be an issue. But they're papering over their centralization and scaling problems by hosting big media externally, and relying on the fact that notes are usually small and servers are fast.