Wasn't referring to what Meta could do or even necessarily that there's an issue with Lemmy's software. More that there's a bunch of servers with various configurations without resources dedicated to intrusion detection, mitigation or reporting. If something did happen at a server level to a hobbyist instance there's no reason to believe users or maybe even the person's running the instance would know about it.