Brute-forcing is infeasible. The meta-data is certainly visible however, so intelligence agencies could glean a lot of information about certain users from other sources. You're right that "private conversations" does throw up a red flag.