indeed, that's my point, and why i say "more impossible" because it is definitely in practice easier to catch events on nostr
but the situation is no different on farcaster and bluesky and mastodon also, if you are running infrastructure, you see it... hell, bluesky DMs aren't even encrypted, only gated by authentication and then it's "trust me bro" the federation node operator isn't snarfing the data
so, yeah, not a problem only for nostr but for decentralised and semi-decentralised social media in total
and even centralised social media has screenshots, even if they don't expose APIs or RSS feeds
fact of life, get over it, welcome to the internet, 50 years later, it's finally dawning on the population that it means a real permanent record