Chat sessions on atproto apps are not generally public. For example, the Bluesky app has private chat and Germ (https://germnetwork.com/) is an E2EE messaging app built on atproto as its identity system.
Regarding the open data— we do believe that anyone should be able to publish in the open, and building should be permissionless much like the web. But we don't think all data should be public, and clearly there is strong demand in the world for private spaces.
The community is working intently on bringing permissioned data to AT Protocol, and there are already several working examples out there illustrating different approaches. The head of protocol at Bluesky, where I also work, has been publishing his views on where permissioned data is heading: https://dholms.leaflet.pub/3mhj6bcqats2o
On the upside, atproto "instances" (we often call them "personal data servers") have much less responsibility than the typical Mastodon instance. So folks should find them quite cheap and easy to run. One reason is that they don't need to directly support application features such as timeline construction, search, image optimization, etc: they just host your social data.
We have 10 servers federating in production, each housing around 270,000 users, and it all runs on disk and sqlite, quite affordable! We migrated 2 million users off a single large host onto these 10 smaller ones transparently and without need for much fanfare. We're dedicated to the tech and seeing it work in production has been super heartening.
Regarding the open data— we do believe that anyone should be able to publish in the open, and building should be permissionless much like the web. But we don't think all data should be public, and clearly there is strong demand in the world for private spaces.
The community is working intently on bringing permissioned data to AT Protocol, and there are already several working examples out there illustrating different approaches. The head of protocol at Bluesky, where I also work, has been publishing his views on where permissioned data is heading: https://dholms.leaflet.pub/3mhj6bcqats2o