At some level you’re not missing anything: there are obvious solutions, and they’re largely ignored. Blocking is effective, and it’s a key part of why some instances actually do provide good experiences; and an allow-list approach works well. But, those aren’t the default; so new instances don’t start out blocking anybody. And, most instances only block the worst-of-the-worst; there’s a lot of stuff that comes from large open-registration instances like .social and .world that relatively few instances block or even limit.