Anything that touches the internet can be scraped. Mastodon DMs aren’t encrypted, and public posts are obviously public. There’s nothing stopping someone from using the API or any web crawler to harvest data on mastodon users anyway.

Not arguing for/against threads, tbh I don’t even use mastodon much because I don’t really like the idea of microblogging to begin with