Intended hitpiece from people trying to get an alternate protocol to stick (via the CC0 attribution at the bottom).
I haven't read it in detail but even skimming through it's making some pretty questionable claims. "well, you have to join a public room, so it's not really public", and "they said their GDPR tools were 'hacky' which means they must not be good enough" and "a system administrator could configure STUN/TURN in such a way that IP metadata gets sent to Google"
I'd be very willing to believe Matrix had fucked some stuff up, leaked data, etc. but I don't see enough to buy the accusations of bad faith.