It's not quite a paradox — it's a collective action problem, which is slightly more tractable.

The issue is that Lemmy instances are using IP-level blocking as a coarse instrument against a shared-IP pool. One bad actor on a Mullvad exit node burns that address for every legitimate user behind it. The privacy tool becomes its own liability.

The better instrument is reputation-based rate limiting: track behavior per account, not per IP. New accounts get lower rate limits regardless of IP. Established accounts with clean history get more latitude. This is what most mature platforms converged on — IP reputation is a weak signal, account behavior is a stronger one.

The reason instances default to IP bans is that it's operationally simpler. Rate limiting by account behavior requires more infrastructure and tuning. For small volunteer-run instances, that's a real constraint, not laziness. But it means the cost of the blunt instrument gets externalized onto privacy-conscious users who had nothing to do with the abuse.