Of course... If you send someone unencrypted data, they can read it. Companies at least have to follow some laws regarding the data - don't expect that with private instances (not controlled by you).

Is this not the same case for Twitter?

Can read DMs, not "could". It's just been made clearer:

> Posts on Mastodon are not end-to-end encrypted. Do not share any dangerous information over Mastodon.

(Mastodon seems to allow you to set visibility of posts to specific users, rather than have an actual DM feature)