Well, think about some similar situations.

If you post something on a public website and it gets indexed by search engines, how does that work? Or how about sending email to a mailing list that subsequently sends it on to all the recipients?

In each case those organisations would likely be data controllers rather than processers, so would need a privacy policy, decide on their legitimate basis for processing, mechanisms to handle SAR/RTBF/etc. My guess is Lemmy servers would need the same thing.