I believe they can but it would basically be dependent on trust and no one sharing the address and key, similar to a Zoom password for a meeting, and I do believe you need your own relay for that, which is set up as private from the jump otherwise it will go "out there." I assume and hope DMs are private and encrypted.