When you type up a DM on Mastodon, there’s a little popup notice that appears next to the text box that says: “Posts on Mastodon are not end-to-end encrypted. Do not share any sensitive information over Mastodon.” IMO the platform is responsible about informing users about this.