There’s a vulnerability in plain sight right now, based on @Mastodon not supporting the Client-Server aspect of #ActivityPub.
Net is effect:
Clients are Mastodon-specific rather than ActivityPub based (what the #Fediverse is supposed to be about).
As you know, this is how the beginning of the end starts, since there’s no longterm protection from open standard compliance.