In fairness to them, they're trying to build in public, and didn't expect this much attention yet.
They opened their invite-only private beta, where they hoped to control a tiny user list, before they'd even implemented blocks.
Sign-ups are protected by sign-up keys, but unfortunately, they didn't rate-limit their sign-up API, and the keys were quite short, so someone wrote a script to brute-force guess sign-up keys. So some nazis got in. 🤷🏿♂️
Blocks are being implemented this week.