Limitations no, if anything the protocol is too extensive and lets you do too many things (or do the same thing in different ways). But thats somewhat expected for a protocol which can handle all types of social media platforms. I think the protocol is fine as is, but it needs minor changes here and there to keep up with how it is being used in the real world. The FEP process is doing a good job of that.
From what I know the AT protocol used by Bluesky is entirely centralized, so it doesnt look like a competitor yet. They claim that it will be decentralized in the future, but I will believe it when I see it. For now the decentralization seems more like a marketing gimmick.