It’s more about comparing a diffuse risk with a really personal risk. Sure, your data is misused by giant corporations, but you don’t know the people who exploited your data and you never will, which makes this risk almost abstract. You know it happens, but it rarely has any direct consequences for you, or you might not be able to link them with the corporation.

On the opposite side, there’s a smaller risk of a Mastodon admin reading your DMs, but it carries a risk of direct and personal consequences that may feel outsized because of how easy it is to imagine these consequences and link them to the admin.