public timelines, enable whitelist federation and require authorized fetch for federating

And all of that can be circumvented by pulling the data via the RSS feeds or plain old scraping.

Authorized fetch and domain blocks may be effective to stop drive-by trolls, but do nothing to stop anyone with a minimal amount of resources and interest in scraping data from a social network.

The reality is simple: all information that you put on the web should be considered as publicly available. Those that want or need absolute privacy should not use information in the fediverse and resort only to provably secure communication protocols.

I don’t know of any major instances that have enabled any of those… And all getting around it would take is to create an account on the instance- which for instances without admin approval can be done fully programmatically anyway so it wouldn’t even require human intervention, just a few extra lines of code.

If your instance is federated it doesn't matter how "locked down" your instance is it's pushing data out of the walled garden lol

And that's ignoring the fact you can just create an account on the target instance then hit the instance's API