If you’re paranoid, you can use PGP and send encrypted messages through Lemmy. But obviously that’s overkill.

My approach: assume that DMs are probably going to stay private, but acknowledge that there’s always a chance they leak out one way or another. If you want to send a link to a more secure service, perhaps that service allows you to generate a temporary link that you can deactivate after the recipient has used it. That would still be untraceable, as long as the eavesdropper isn’t opening that link immediately after you sent it.