Unpopular opinion but social media has always been fundamentally public.
Unless they're scraping private dm's on encrypted devices, this should come as no surprise to anyone.
The good news is that nobody has exclusive right to data on federated platforms, unlike other sites that will ransom their user's data for private use. Let's not forget that many of us migrated here because the other site wanted to lock down their api and user data so that they could auction it to google for profit.