I feel like the federation part of Misskey was very slapped on. IIRC it was an afterthought while Pleroma and maybe Mastodon, don’t take my words on it, had it from the get-go.
During the attack on Pawoo, Shadowferret had to block that instance entirely while Awoo set its media policies to reject images from Pawoo while accepting everything else. There wasn’t actually anything bad coming into Awoo from there, thankfully.