this pixelfed bug really feels like a design problem at the protocol level to me; it requires way too much unearned trust to expect a network of programs that are highly decoupled and barely trust each other to enforce one another's access controls, especially on the level of individual posts