I can confirm that DMs are not encrypted and are stored in clear text and therefore could technically be read by admins with database access.
While we are not actively looking or browsing through DMs, I'd still recommend not sharing anything sensitive through lemmy DMs and instead use something like Matrix or Signal.