In theory, yes, nodes can read canister state. This is a good post if you are looking to understand more about nodes and canister state: Guarding against malicious node providers - #2 by diegop
In the future, you could secure the data using VetKeys.