Matrix stores all this info and gives it freely to other servers retroactively(!)
Can you show me the part of the spec that allows a server with no room members to get private room info from another server? I'm skeptical, but if true, I believe that would be worth reporting as a bug.
network layer sniffing (which is anyway much harder to do)