Ah thanks, ok - I see their warning here:
Security Warning
This standard does not go anywhere near what is considered the state-of-the-art in encrypted communication between peers, and it leaks metadata in the events, therefore it must not be used for anything you really need to keep secret, and only with relays that use AUTH to restrict who can fetch your kind:4 events.
I think this is important for people to understand. I will take a deeper look at their model.