You can always trust a large cooperation to keep your data secret more than any random individuals. They have accountability for losing your data, much more so than the people on the fediverse. A big data breach leads to class action for reddit, here it just takes down an instance and lowers the validity of the technology.

The difference is that you can take reddit/Twitter/Facebook to court over violating your privacy, you won’t have anywhere near that kind of luck with fredeverse hosts. If you notice, there isn’t really a TOS, those are filled with regulatory agreements from governments that says what they can and can’t do with your data. Here we’re hanging with our ass in the breeze. Best solution right now if you want to receive DMs is to use an encrypted app and block all DMs here.