Notes are not encrypted. Only direct messages are (kind4). So relay operators are aware of what they are distributing.