Answer
Do photos sent in direct messages keep their EXIF data?
Frequently yes. Direct messages follow a different code path from public posts, and the attachment or document modes exist precisely to deliver a file untouched.
Updated
Almost every write-up about platform metadata handling measures one thing: what happens to a photo you post publicly. That copy is re-encoded, and re-encoding discards the metadata block as a side effect. It is a real result, and it is the wrong result to generalise from.
A direct message is a different pipeline. The public-post pipeline exists to serve a resized image to thousands of viewers, so it re-compresses aggressively. The messaging pipeline exists to hand one file to one person, and on several platforms it is explicitly designed to preserve the original — that is the entire point of "send as file", "send as document" or "send uncompressed".
The consequence is backwards from what most people assume. The more careful you are about quality — choosing document mode so your friend gets the full-resolution original — the more certainly you are also sending your GPS coordinates, your camera body's serial number and the exact second the shutter fired.
There is no reliable way to reason your way through this per platform, because the behaviour is undocumented and changes without announcement. The only answer that survives a platform changing its mind is to remove the metadata before the file leaves your device.
More on this: Guides, Does Instagram remove EXIF?.
Terms used here: Re-encoding.