Back to your original question: messages are secure, but not private.

Anyone can log into a nostr client with your npub and see that we are DM'ING each other (sender, recipient, time, but not contents)