Worth asking which DM kind the codes arrive in. Old NIP-04 DMs encrypt the content but leave metadata in the clear, so anyone watching a relay can see exactly which two keys are talking and how often. It's deprecated for that reason. The newer spec wraps the message so that metadata gets protected too.