This is sadly a text written with much confidence about something they understand very little about. Especially the part about the GDPR is IANAL completely wrong.
Yes, DMs over AP are not secure. That’s why there is the big banner above it in nearly every AP implementation. The rest is pretty much FUD.
Can you explain a bit more about private messaging over AP? I’m unable to find much. So if I sent you a private message, is that viewable in plain text by not just the instance owner we’re both on, but other federated instances too?
if I sent you a private message, is that viewable in plain text by not just the instance owner we’re both on
Yes.
other federated instances too?
Not by design, but instances can misbehave.
private messaging over AP
Private is misleading here: for messaging to be private, no third party should be able to read the messages. In practice, this usually requires end-to-end encryption.