ActivityPub doesn't do DMs per se. Many ActivityPub implementations will use AP messages that are not posted on any public list or timeline. Basically, a Tweet with visibility set to "only people mentioned in this thread".
This design makes it quite easy for AP servers to misimplement DMs. Asking a server for all messages of a particular user (to get their timeline) and forgetting to filter out messages not published globally is trivial to get wrong.
ActivityPub DMs are, in my opinion, not a good feature. This has come up before in Mastodon, where DMs mentioning a third account will add that account to the thread and destination of all future messages (and possibly authorise it for accessing past messages); one mention will give them full access to your "direct" messages.
I doubt this scraper did anything wrong here, I think it's just a matter of a buggy server or users sending DMs that aren't really DMs because of Fediverse software with GUI design flaws.