That is 100% correct -- a Visitor Message is like a public posting on the user's "Wall" (like Facebook). If you want your message to be private, send a regular PM as usual.