Disabling may be not sufficient (which is pretty insidious), but I still posit that enabling message preview is guaranteed secrecy loss.

But indeed, the idea that disabled notifications are still stored, and not directed to /dev/null immediately, cannot be inferred from just observing the behavior of the phone UI.