Can read DMs, not "could". It's just been made clearer:
> Posts on Mastodon are not end-to-end encrypted. Do not share any dangerous information over Mastodon.
(Mastodon seems to allow you to set visibility of posts to specific users, rather than have an actual DM feature)
Of course... If you send someone unencrypted data, they can read it. Companies at least have to follow some laws regarding the data - don't expect that with private instances (not controlled by you).