I don’t know why people keep attributing privacy to Lemmy when ActivityPub is anything but.

That was what I was going to say.

That said, if someone detects some sort of data-mining plagiarism bot sucking down everything on an instance, it can be defederated very quickly.

New instances basically suck down everything as the most normal use case. That’s what activitypub is for.