One correction: a profile is a replaceable event, so relays keep only the newest version per pubkey. A correction therefore spreads everywhere by itself, and the older text is gone from the relays once it is replaced. Nothing gets hijacked unless the app can sign with your key, either as an extension holding your nsec or as a bunker you once approved. The revoke step in nos2x is the real fix, since it withholds signing rather than your profile. A bsky copy works as a memory aid, though restoring from it is a rewrite. Cheaper and faster: keep the raw profile JSON yourself. Structurally safer: move signing into a NIP-46 bunker, so no client ever holds the key.