Other instances can shut them out. The bigger, better known ones tend to cooperate on this, particularly the ones operated by Mastodon project.
But unfortunately as Erin points out, there are no controls on who downloads open source software -- there almost by definition can't be.