From what I understand it's not completely EE2E but rather the lite version. Something about relays metadata that's making it not completely Ee2E.
But yeah it's still a step from anyone viewing all your messages if they login using your npub.