@lanodan @p Not sure about DMs, aren't these sent encrypted? Logins, passwords, access tokens on the other hand are exposed
As for protection - I get why people find it tempting. Fedi software is mostly not very efficient and servers people run are often very modest and struggling under load. It doesn't take much to bring one down even by a couple of crawler bots or another malfunctioning fedi server let alone deliberate DDoS. And there's such nice free offer :)