Also, I figure (if it hasn’t happened already) some federated instances out there are nefarious, set up to harvest data.

[Citations needed] or it didn’t happen. There’s precious little extra information that a “nefarious” instance can harvest that any basic web scrapper can’t.