"It is more secure because it is open source and that means more eyes on the code."

This is unscientific and magical thinking. It is not how security works in reality.

The paper highlights the converse of this mantra:

"Despite significant attention, the security of Nostr has not been thoroughly investigated to date."

Just because a thing is open source it does not logically follow that there are actually eyes on the code. That is the wishful thinking part. There are millions of open source applications with not enough manpower to do thorough security analysis of all that code, especially since nobody is being paid to take the time for analysis.

For example, I recommend DarkMX even though it is closed source. It has been available for many years and I have neither seen nor found an effective exploit. The developer has an impeccable reputation of producing simple, quality software for decades. People trust closed source Microsoft applications, and the DarkMX developer is much more trustworthy.

To have faith in a trustless model you have to trust someone making a security claim anyway. At that point I evaluate the risk factors to decide whether or not to use the software. I have zero trust in the people behind NOSTR.