Fediverse

ActivityPub is a standard, Lemmy, KBin & Mastodon are open source applications built on the standard. It's the same relationship as Hypertext Transfer Protocol (HTTP) and Chrome, Safari, Firefox, Apache & IIS.

As a client/server architecture, Lemmy is no more or less vulnerable to malicious actors than a web browser or a web server. You're at least as likely to have a rogue admin mishandle data as someone build Evil-Lemmy. While I consider myself a good netizen, if you delete this post right now I'm still going to have a copy for at least six months because that's my current backup retention for this instance.

I'm no GDPR expert but I can't see how an instance owner who does comply with GDPR can be punished for instances they don't control not deleting federated data. There are ongoing conversations throughout the Fediverse on this topic.

IANAL, but the GDPR only concerns itself with personal data (name, address, email, IP etc.) for deletion requests. These however are not necessarily shared with other ActivityPub servers, so if you delete them of your own server it should be sufficient.

I can only comment on the content part: if someone posts content that’s against your instance policy you can either block their instance or the user afaik

My first concern is that if the platform is open source someone can host a malicious version of it, where certain requests may be ignored (such as deletion).

Just so you know, this is not a fefiverse specific issue. Third party websites have cropped up to scrape sites like Reddit and post archived versions of undeleted posts for decades. I'm not sure your concern relates to the fefiverse at all.