Private messages are completely private, you as normal user can never see someone elses private message. The only ones who can theoretically read private messages from other users are instance admins. Exactly the same on Reddit or Twitter by the way. But if any admin actually does that, people would quickly spread the word and leave that instance.

End-to-end encryption does add some extra security in that admins also cannot read other users private messages. I dont think that people really send very sensitive information through Lemmy private messages, it is better to use an actual messenger application for that.