“secure” is relative. They may not be e2e encrypted, but they are still encrypted via TLS, like any HTTPS traffic. It’s the same encryption used for online banking. If you care about your instance admin being able to read your messages, you should use Signal or a Matrix client though.
But remember that only a few years ago, almost nobody used e2e encryption, and it wasn’t much of an issue.