This presumably uses something like Diffie-Hellman[0]. Getting the URL isn't enough to decrypt the message. Even if you intercept 100% of the data passed between the two users, they still end up with information that you don't.
Now if you intercept and replace the URL, they may be in trouble.
I guess technically they don't have information you don't have, but they have it in a usable form—e.g., they have two prime numbers and you just have the product.
Now if you intercept and replace the URL, they may be in trouble.
[0] https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...