>I think the people running the servers have a lot of access and power, it's been mentioned as a possible issue

Yes Mastodon DM's are basically posts with viewers restricted to the sender and recipient. It is in their roadmap to add E2E encryption, but not there yet. More info here: https://www.eff.org/deeplinks/2022/11/mastodon-private-and-secure-lets-take-look