Pretty much this. If you're pasting your nsec into clients you're doing it wrong. If you're using a native client and you don't trust it, don't use it. If you're using a web client, you should be using nos2x or Alby or some other nsec-managing extension.