Yes, and everyone needs to keep in mind that given the design decisions behind ActivityPub, all privacy related issues are on a voluntary basis.
If you post content with a specific audience, that will probably get actively broadcast to a different instance whose operator has every ability to ignore the privacy settings, rebroadcast the content publicly, and ignore all requests for deletion.
This is an ax I grind around here because so many people don't realize how weak privacy protections are when they act on this platform.