Or have I misunderstood?
I suspect the response will be that content on your instance should always be considered public, and that you can’t really stop a bad actor from spinning up fake instances or scraping your site for the data regardless, but I just wanted to confirm.
No I think you’re right and I’m wrong, it does appear to work that way.
My confusion came from the beehaw de-federation with lemmy.world and it seemed like at one point traffic was a one-way street, but if you go to a beehaw community now via lemmy.world vs from beehaw.org you can see that beehaw content is not arriving at at lemmy.world (because beehaw defederated them), even though lemmy.world has not defederated from beehaw.