Thank you for all your answers, they were very informative. Yes, in the end, it is a social network, it is normal that all activity us public. There also seems to be some trust involve when choosing an instance on which to create an account. And eventually, as one accesses other instances, the private information propagates.

From what I understand, it’s also up to the instance to allow account creation with/without email. They also need to fight bots so most seem to require it.

The PM being public is a bit of a surprise and yes there is a warning at least.