Wouldn’t it just take one bad actor to start spamming all the other instances with nonsence?

In principle yes, one bad actor could start spamming a lot. But they usually get banned pretty quickly.

If you deferate with the instance the bots are coming from they can just open another, right? Like a DDOS attack

Well, you’d need a new domain so at least you’re forcing the spammer to spend money on a new domain, which probably breaks most of these attempts. Also if the spammers are really bad or posting illegal stuff and they’re registering domains, you could maybe report them to their domain registrar and possibly get them to shut them out or maybe even get law enforcement involved to figure out who registered the domains.