I don’t think Microsoft recorded the URLs, just activity from a GDID and IP address at particular timestamps. The authorities would also have subpoenaed records from other accounts they knew were his e.g. Snapchat and Facebook. The GDID was just a way of assigning activity from his device to particular VPN endpoints at particular times. The point of the story is essentially that the GDID allowed them to track his device across multiple IP addresses. But this wouldn’t have been possible without at least some other pieces of the puzzle such as knowing which was his Microsoft account, or Facebook account etc. in the first place.

Surprised no one else has chimed in with this yet - but what is your threat model? Are you conducting terrorist activities? Good luck. Are you wanting private messaging between you and your friends - it’s probably fine - definitely better than texting. I will temper this with just keep in mind anything you send to someone could be screenshot, their partner could see it etc. You need to figure out who your potential adversary is before deciding if a communication channel is “safe”. First ask yourself “safe from what?”.