Malicious peers will always be able to potentially capture traffic from yours and narrow down to your IP address.

Yes you would need to tunnel through some kind of VPN or mixnet. I'm not an expert on Nostr architecture but it does not have any kind of path blinding or mixnet feature as part of it so yes the address you broadcast new data from will be visible to the nodes you first broadcast it to.

Possibly you can reduce this danger by selectively broadcasting to trusted nodes only, but even then you are just ending up in a pool of potentials. All anonymity systems benefit from more users.