Is it really that surprising that the act of reacting to a message with an emoji isn't E2EE, given the server needs to count the number of reactions? One could encrypt the emoji itself, but it doesn't seem like a massively sensitive datapoint in its own right. (That said, we will encrypt them eventually, but it's just not very high priority given the fact it doesn't practically feel very high impact, relative to all the other things we could be doing to improve Matrix).