pg_stat_statements shouldn't hide queryid for other user's queries

The queryid is just a number. Yes, you could reverse engineer the query but only by brute force ...