I agree. ActivityPub messages are not necessarily public information; implementations like Mastodon and Lemmy just assume it - and there’s nothing stopping the services relaying the messages elsewhere afterwards.

Actually in my fiddling with ActivityPub I’ve made some posts and comments to a Lemmy instance which were not relayed to other instances, even though they would have been if I made them using Lemmy. So there’s definitely opportunity for systems to implement features inbetween “totally public” and “single recipient”.