For 3, I think you’re right, but I want to assume someone spins up a malicious server for the purposes of gathering IP addresses, creates an identity that routes through that server, and then picks a target. Would it be possible, at that point, for them to gather their target’s IP address at some point?

For 2, I mean it’s difficult to identify the same person across multiple chats. For example, let’s say your only communication with someone is through simplex. if you DM them, and then you join a group when they are present, there is nothing easily identifying them is the same person. This is the case even if they use the same public facing username in both instances.

(Upon looking, it seems you can set a nickname for a user and it will persist across rooms, and it looks like the QR code is also the same across rooms, but the first one is a bit tedious, and the second one is worse.)