You're missing something, but I'm not sure what... Addresses are always public knowledge, along with all transactions between them. Who owns the address, on the other hand, is usually not advertised: but in this case Instawallet is claiming and endorsing their address to allow for instant payments on your behalf.

I can't tell how this diminishes security, assuming the normal practice of using one-time receiving addresses is still used. EDIT: And assuming you are comfortable having a middleman like Instawallet involved.