if I sent you a private message, is that viewable in plain text by not just the instance owner we’re both on
Yes.
other federated instances too?
Not by design, but instances can misbehave.
private messaging over AP
Private is misleading here: for messaging to be private, no third party should be able to read the messages. In practice, this usually requires end-to-end encryption.