In theory that sounds correct, but what if one of the users boosted the family photo post and they had  additional relays configured?  Seems like the content could end up "in the wild" fairly easily.