Do do you mean that someone can find out your address if you are using the bitpay service to receive payments?
If thats what you have meaned, then yes..

Addresses are public information. Anyone can see them. Even if you use BIP70 payment requests.
At least after someone has made a transaction, he can simply look at a block explorer to look for the receiving address.
But as mentioned above a simple GET-request is also enough to extract the address. This is because BIP70 is just a protocol ontop of the application layer. Transactions are still being sent 'to addresses'.