The source is linked in his post. Did you not read the article? You should provide another source or address the data in the article instead of just asserting it's false with zero argument.
Dealbreaker for Mastodon (that I've seen multiple people mention) is that instance admins can view personal DMs. Yes, employees from major social media companies can view your private messages, but it's more likely there's an audit trail in those cases while Mastodon instances have minimal oversight.