my understanding is if you and the other party both use your own node, then it's encrypted; but if one of the party using LN custodian address, like from Alby, Blink or SN then the node owner can read it too. 👀