Yes it is, but I think you might be assuming that they are even putting their homeserver on the public internet.

But even if it is, then as long as federation is off, nobody else will see any metadata but them.

metadata from Matrix is never 'public' (i.e. visible to the public). It's visible to only the admins of the servers participating in a given conversation.

Sure and I see that they're fully owned by the German government but getting the entire German government to switch (lots of politics involved even if the product is developed by the government) is a lot harder than starting bottoms-up. Getting some departments/small companies to switch and growing organically from there seems like a better path towards success.

I guess they could offer a hosted solution but that's usually a challenge to get approved in most government agencies (even if the contracting party is also sponsored by the government).