Depends if that server is storing every conversation in a non password protected mongo database. I'm going to stick with expecting the entire world is going to see it until security and privacy is valued much greater then currently.

I disagree, assuming there are no other security holes (browser extensions, whatnot) then the server will initially receive it, but they can then forward that data to any third party they wish.

TLS has very little to do with it. Some intermediary parties may be able to read the plaintext, but that's different from putting it on pastebin for everyone to see. I've never heard of ISPs or transit providers publishing privacy-sensitive data or otherwise snooping on it. (Assuming non-business / non-VPN / non-proxy connections. Just an ordinary internet connection.)

The author probably meant if the site gets/is hacked, or if they are later bought by another company, or if a new employee joins and you can see chat history... etc.

Although you're technically right, my point is more along the lines of people just being in the default state of skepticism. Be as secure as you, personally, can possibly be and just assume that everyone else isn't following standard security protocols, that their SSLs are invalid, and that they're monitoring what you're typing.

It's similar to the old adage about driving: "Drive like everyone else is an idiot out to kill you. Don't be right, be predictable."

Not really, because the site probably stores the data and the site could be breached, or they could sell (access to) the data.

Edit: In the worst-case, as per the GP's point.

Well you aren't wrong. I mean technically speaking if there is an SSL certificate, than in fact you are directly connected to the server and no one is in between.

The difference is that if I own the server, I can see your information even though it was a direct server connection. You directly fed the information to me. That is what is happening in these scenerios.

Even in that case, what server? The server belonging to the url in the address bar? Or the one hosting that facebook icon? Or the one collecting the client-side metrics/analytics for the developers? Or the many serving you ads on that page?

If they log keystrokes (for security, UX research or whatever) there's a good chance that they send enough packets to allow an attacker to infer a lot just from observing frequency and length of packets.

Depends on what analytics and ad tracking are also running on that site