@edoggthered DMs are just Toots set to be visible only by those mentioned. In the web interface (and some apps) they get sorted out and treated differently so as to look like DMs do on Twitter.

They feel less secure because of how they're handled, but that's more of a reflection of how Twitter DMs give the appearance of being more secure than they actually are (the Twitter Admins could read your DMs any time they wanted too).